Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-35473

An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-35473
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 10:02 UTC · Revision 1

Source evidence

CVE-2021-35473

core-osv · Original source

Published 10 Nov 2024, 23:15 UTC

An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.

osv:CVE-2021-35473
Complete source record
{
  "id": "e5cfb6ee46a870071a84ec0f880f3cc6ec6257b4b6f2e188cc90fc45eb52d099",
  "url": "https://osv.dev/vulnerability/CVE-2021-35473",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-35473",
    "summary": "An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.",
    "evidence": "osv:CVE-2021-35473",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2021-35473",
      "aliases": [
        "CVE-2021-35473"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "8d3b763b6af2b8a9c4ad2765fbfabffec8a73af5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.0.12"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.0.2",
            "ubuntu/disco",
            "debian/buster",
            "v2.0.11",
            "ubuntu/hirsute",
            "debian/bullseye",
            "v2.0.10",
            "v2.0.9",
            "v2.0.8",
            "ubuntu/groovy",
            "v2.0.7",
            "ubuntu/focal",
            "v2.0.6",
            "v2.0.4",
            "v2.0.3",
            "v2.0.1",
            "v2.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-35473.json"
          }
        }
      ],
      "modified": "2026-10-20T10:49:44.755199567Z",
      "provider": "osv",
      "references": [
        "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/tags",
        "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2549"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-35473",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 380763,
  "published_at": "2024-11-10T23:15:04.383+00:00"
}