Fedora LemonLDAP-ng Updates Address Open Redirect Vulnerability CVE-2026-12804

Linuxsecurity

Fedora LemonLDAP-ng Updates Address Open Redirect Vulnerability CVE-2026-12804

First seen 3 Aug 2026, 06:02 UTC • •45.9

Article Content

1 / 3

Browse articles

ThreatCluster •August 4, 2026 at 05:50 UTC

•CVE-2026-12804 is an Open Redirect vulnerability in LemonLDAP-ng affecting versions 2.23.1 and 2.23.2.
•Users are urged to update to the latest versions to prevent potential unauthorized access.
•The vulnerability was published on June 21, 2026, and is actively being addressed by Fedora.

Fedora has released updates for LemonLDAP-ng versions 2.23.1 and 2.23.2 to address CVE-2026-12804, which is an Open Redirect vulnerability. This flaw allows attackers to manipulate URLs in the SAML Common Domain Cookie Endpoint, potentially leading to unauthorized access. The vulnerability was published on June 21, 2026, and affects users of the LemonLDAP-ng web single sign-on solution. Users are advised to upgrade to the latest versions to mitigate risks associated with this vulnerability. The updates were made available through the dnf package manager. The updates were confirmed by developer Clement Oudot and the Fedora Release Engineering team. Organizations using affected versions are at risk of exploitation if they do not apply the patches promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 99d ago How this analysis works

Timeline

2026-06-21

CVE-2026-12804 published

An Open Redirect vulnerability in LemonLDAP-ng was disclosed, allowing URL manipulation in SAML endpoints.

2026-07-16

LemonLDAP-ng version 2.23.0 released

Fedora Release Engineering rebuilt LemonLDAP-ng version 2.23.0 as part of the update process.

2026-07-22

LemonLDAP-ng version 2.23.1 released

Clement Oudot released version 2.23.1, which includes fixes for the Open Redirect vulnerability.

2026-07-24

LemonLDAP-ng version 2.23.2 released

Clement Oudot released version 2.23.2, further addressing the Open Redirect vulnerability.

More articles in this cluster (2)

Threat Graph

8 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (1)

Fedora

Vulnerability (2)

CVE-2026-12804
Open Redirect

Weakness (1)

CWE-601 - Open Redirect

Affected Platform (3)

Apache
Lemonldap-ng
Linux

Relationships

CVE-2026-12804 targets Apache
CVE-2026-12804 targets Lemonldap-ng
CVE-2026-12804 targets Linux
Open Redirect targets Apache
Open Redirect targets Lemonldap-ng
Open Redirect targets Linux
Zero-day Exploit targets Apache
Zero-day Exploit targets Lemonldap-ng
Zero-day Exploit targets Linux
CVE-2026-12804 related to Fedora
CVE-2026-12804 related to CWE-601 - Open Redirect

Following this threat?

Track Fedora and CVE-2026-12804 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…