CVE-2024-52946

What it actually does

An authenticated user can bypass the intended absolute authentication level assignment during session refresh when an adaptive authentication rule uses an increment value, allowing unauthorized elevation of session privileges.

Why it matters to the business

Attackers with valid credentials can gain higher access rights than intended, potentially exposing sensitive applications and data across organizations using this identity federation product; the flaw has been public for over a year with no observed mass exploitation.

How an attack unfolds

An attacker authenticates with a low-level session, triggers a session refresh while an adaptive rule configured with an increment is active, and the improper check allows the increment to raise the authentication level beyond the configured maximum.

How to fix it

Upgrade LemonLDAP::NG to a build containing commit fe2718cc2dd849966f690fb995d96f9ea391fa3f (equivalent to version 2.20.1 or later) and review all adaptive authentication rules to ensure they use absolute values rather than increments.

How to confirm the fix worked

Confirm the installed version includes commit fe2718cc2dd849966f690fb995d96f9ea391fa3f, audit adaptive authentication rules for increment usage, and test session refresh behavior under those rules to verify levels remain absolute.

Typical attack path

1. Obtain valid low-privilege credentials for the LemonLDAP::NG instance
2. Initiate a session and trigger the session refresh mechanism
3. Ensure an adaptive authentication rule using increment (instead of absolute value) is evaluated
4. Observe the authentication level increase without re-authentication

How to detect it

Review LemonLDAP::NG session and authentication logs for unexpected authentication level increases during refresh events; correlate with user activity that would not normally trigger re-authentication.

What your security team should do

• Immediately upgrade all LemonLDAP::NG instances to the fixed commit or 2.20.1+
• Audit and correct any adaptive authentication rules that rely on increments
• Monitor authentication level changes in logs for unexpected elevations
• Prioritize this update given the high CVSS score and public disclosure date