Critical severity · published Dec 28, 2020
CVE-2020-26290
Dex is a federated OpenID Connect provider written in Go
9.6
CVSS
1%
EPSS
No
On KEV
Description
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Dex · Linuxfoundation
before 2.27.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26290
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26290
Patch
https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8
Third Party Advisory
https://github.com/dexidp/dex/releases/tag/v2.27.0
Third Party Advisory
https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
Not Applicable
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md
Not Applicable
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
Not Applicable
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
More from Dex
9.8
CVE-2020-27847
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation
7.5
CVE-2024-23656
Dex is an identity service that uses OpenID Connect to drive authentication for other apps
6.5
CVE-2022-39222
OAuth authorization code exposure in Dex