CVE-2020-24660: lemonldap-ng-handler - Lack of URL normalization may lead to authorization bypass
Summary
CVE-2020-24660: Lack of URL normalization may lead to authorization bypass when URL access rules are used. Affects lemonldap-ng-handler versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Also tracked for
- lemonldap-ng · Debian:11
The same CVE-2020-24660 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lemonldap-ng-handler is an npm package that provides URL normalization and authorization capabilities for LemonLDAP::NG, an open-source web single sign-on (SSO) solution. It is designed to protect web applications by enforcing access rules and filtering URLs. However, a vulnerability in the package's URL normalization process can potentially bypass the access rules and allow unauthorized access to protected resources.
Vulnerability Detail
The lack of URL normalization in lemonldap-ng-handler can lead to an authorization bypass when URL access rules are used. This means that certain URL encodings may evade the filtering system and grant unauthorized access to protected resources. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. It was assigned the identifier GHSA-x44x-r84w-8v67 and the alias CVE-2020-24660. The vulnerability was discovered on September 9, 2020, and the patch was released in version 0.5.2 of the package.
How To Fix
Latest published version: 0.9.6 as of 23 Oct 2026
npm install lemonldap-ng-handler@0.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.2
This is the first release that contains the fix.
npm install lemonldap-ng-handler@0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to upgrade to the patched version of lemonldap-ng-handler to mitigate the risk of an authorization bypass.
Conclusion
The lack of URL normalization in lemonldap-ng-handler can lead to an authorization bypass vulnerability. To mitigate this risk, users should upgrade to version 0.5.2 or later of the package. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lemonldap-ng-handler →
FAQ
lemonldap-ng-handler is an npm package that provides URL normalization and authorization capabilities for LemonLDAP::NG, an open-source web single sign-on (SSO) solution.
The vulnerability allows for an authorization bypass when URL access rules are used, potentially granting unauthorized access to protected resources.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
To fix the vulnerability, it is recommended to upgrade to version 0.5.2 or later of lemonldap-ng-handler.
There is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
