CVE-2020-27847

Published: May 28, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

Affected (1)

Products: Linuxfoundation: Dex

Linuxfoundation

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Dex	Before 2.27.0

Related CWEs

Improper Handling of Syntactically Invalid Structure

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

References (6)

https://bugzilla.redhat.com/show_bug.cgi?id=1907732

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5

Source: secalert@redhat.com

PatchThird Party Advisory

https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1907732

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.