CRITICAL🇵🇱 Wersja polska

CVE-2020-26290

CVSS 9.3v3.1pub. 2020-12-28upd. 2024-11-21

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

  • Linuxfoundation Dex

    APP
    Linuxfoundation
    < 2.27.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-39222CRITICAL9.3PL ✓same product

Kradzież kodu autoryzacji OAuth w Dex (OpenID Connect) — dostęp do tokenów

CVE-2020-27847CRITICAL9.8PL ✓same product

Pominięcie uwierzytelniania SAML w bibliotece Dex (dexidp/dex)

CVE-2024-23656HIGH7.5same product

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves ...

CVE-2026-53488CRITICAL9.4PL ✓same vendor

containerd CRI plugin: brak walidacji etykiet obrazu umożliwia RCE na hoście

CVE-2026-44477CRITICAL9.4PL ✓same vendor

CloudNativePG: eskalacja uprawnień do superużytkownika PostgreSQL przez metrics exporter