CVEvulnerability
CVE-2020-27847
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-05-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-228
Description
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
Affected configurations
• linuxfoundation dex (< 2.27.0)
Related
Weakness · CWE (1)
- CWE-228 Improper Handling of Syntactically Invalid Structure weakness
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1907732 Issue Tracking, Third Party Advisory
- https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 Patch, Third Party Advisory
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1907732 Issue Tracking, Third Party Advisory
- https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 Patch, Third Party Advisory
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ Vendor Advisory