CVE-2020-26290: dexidp dex
Vulnerability summary
CVE-2020-26290 is a critical (CVSS 9.6) vulnerability in dexidp dex. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 28-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.99%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
+0.01 pp
From 0.98% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-228Improper Handling of Syntactically Invalid StructureThe product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected systems
Chainguard1 product
- kotsAll versions (No fix recorded)
Dexidp1 product
- dex< 2.27.0
Github.com/dexidp1 product
- dex< 2.27.0
Github.com/russellhaering1 product
- goxmldsig< 1.1.0
Linuxfoundation1 product
- dex< 2.27.0
Opensuse1 product
- dex-oidc&distro=openSUSE Tumbleweed< 2.28.1-1.3
Wolfi1 product
- kotsAll versions (No fix recorded)
7 vendors · 7 products
References
15 links- github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.mdX Refsource MISCAdvisoryWEBNot ApplicableThird Party Advisory
- github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.mdX Refsource MISCAdvisoryWEBNot ApplicableThird Party Advisory
- github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.mdX Refsource MISCAdvisoryWEBNot ApplicableThird Party Advisory
- mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/X Refsource MISCAdvisoryVendor AdvisoryNot ApplicableThird Party Advisory
- github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5X Refsource CONFIRMAdvisoryWEBFIXPatchThird Party Advisory
- github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7X Refsource MISCAdvisoryWEBNot ApplicableThird Party Advisory
- github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8X Refsource MISCFIXWEBPatchThird Party Advisory
