Fedora LemonLDAP-ng Updates Address Open Redirect Vulnerability CVE-2026-12804

Linuxsecurity

Fedora LemonLDAP-ng Updates Address Open Redirect Vulnerability CVE-2026-12804

First seen 3 Aug 2026, 06:02 UTC • •45.9

Article Content

1 / 3

Browse articles

ThreatCluster •August 4, 2026 at 05:50 UTC

•CVE-2026-12804 is an Open Redirect vulnerability in LemonLDAP-ng affecting versions 2.23.1 and 2.23.2.
•Users are urged to update to the latest versions to prevent potential unauthorized access.
•The vulnerability was published on June 21, 2026, and is actively being addressed by Fedora.

Fedora has released updates for LemonLDAP-ng versions 2.23.1 and 2.23.2 to address CVE-2026-12804, which is an Open Redirect vulnerability. This flaw allows attackers to manipulate URLs in the SAML Common Domain Cookie Endpoint, potentially leading to unauthorized access. The vulnerability was published on June 21, 2026, and affects users of the LemonLDAP-ng web single sign-on solution. Users are advised to upgrade to the latest versions to mitigate risks associated with this vulnerability. The updates were made available through the dnf package manager. The updates were confirmed by developer Clement Oudot and the Fedora Release Engineering team. Organizations using affected versions are at risk of exploitation if they do not apply the patches promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 47d ago How this analysis works

Timeline

2026-06-21

CVE-2026-12804 published

An Open Redirect vulnerability in LemonLDAP-ng was disclosed, allowing URL manipulation in SAML endpoints.

2026-07-16

LemonLDAP-ng version 2.23.0 released

Fedora Release Engineering rebuilt LemonLDAP-ng version 2.23.0 as part of the update process.

2026-07-22

LemonLDAP-ng version 2.23.1 released

Clement Oudot released version 2.23.1, which includes fixes for the Open Redirect vulnerability.

2026-07-24

LemonLDAP-ng version 2.23.2 released

Clement Oudot released version 2.23.2, further addressing the Open Redirect vulnerability.

More articles in this cluster (2)

Threat Graph

8 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (1)

Fedora

Vulnerability (2)

CVE-2026-12804
Open Redirect

Weakness (1)

Cwe-601 - Open Redirect

Affected Platform (3)

Apache
Lemonldap-ng
Linux

Relationships

CVE-2026-12804 targets Apache
CVE-2026-12804 targets Lemonldap-ng
CVE-2026-12804 targets Linux
Open Redirect targets Apache
Open Redirect targets Lemonldap-ng
Open Redirect targets Linux
Zero-day Exploit targets Apache
Zero-day Exploit targets Lemonldap-ng
Zero-day Exploit targets Linux
CVE-2026-12804 related to Fedora
CVE-2026-12804 related to Cwe-601 - Open Redirect

Following this threat?

Track Fedora and CVE-2026-12804 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Global Phishing Campaign Exploits Google Services for Credential Theft A large-scale phishing campaign is leveraging trusted Google infrastructure to bypass email security measures and steal credentials. The operation uses a multi-stage redirect network that includes six distinct Google services, making it difficult for security systems to detect malicious activity. Victims are presented…

Moderate Patch Released for openSUSE python-Authlib Vulnerability CVE-2026-41479 A moderate patch has been released for the python-Authlib library to address CVE-2026-41479, which allows crafted authorization requests to cause unauthenticated open redirects. This vulnerability affects openSUSE Leap 15.6 and Python 3 Module 15-SP7. The CVE was published on June 22, 2026, and has a CVSS score of…