Critical severity · published May 28, 2021
CVE-2020-27847
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Dex · Linuxfoundation
before 2.27.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27847
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1907732
Patch
https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
Vendor Advisory
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
More from Dex
9.6
CVE-2020-26290
Dex is a federated OpenID Connect provider written in Go
7.5
CVE-2024-23656
Dex is an identity service that uses OpenID Connect to drive authentication for other apps
6.5
CVE-2022-39222
OAuth authorization code exposure in Dex