CVE-2023-28862 (published 2023-03-31T00:00:00)
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.
Affected products: Vendor: n/a
Product: n/a
Versions: n/a