VULNERABILITY INTELLIGENCE

CVE-2020-27847

CVSS score9.8 CRITICAL

EPSS probability1.72%

CISA KEVNot currently listed

Published2021-05-28

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

Weakness classification

secalert@redhat.com: CWE-228

Primary references

secalert@redhat.com — Issue Tracking, Third Party Advisory
secalert@redhat.com — Patch, Third Party Advisory
secalert@redhat.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory