Critical security issues in XML encoding in Dex
Priority MEDIUM 43CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
Why it matters now
EPSS 0.00989 62nd percentileScored 2026-11-07
Fix Fixed dex (dexidp): 2.27.0github.com/dexidp/dex (Go): 2.27.0+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | dex | before 2.27.0 | 2.27.0 | Patch available | CNA |
| — | github.com/dexidp/dex (Go) | before 2.27.0 | 2.27.0 | Patch available | GHSA-m9hp-7r99-94h5 |
| — | github.com/russellhaering/goxmldsig (Go) | before 1.1.0 | 1.1.0 | Patch available | GHSA-m9hp-7r99-94h5 |
- dex Vendorbackstage Affected before 2.27.0 Fixed in 2.27.0 Patch available CNA
- github.com/dexidp/dex (Go) Vendor— Affected before 2.27.0 Fixed in 2.27.0 Patch available GHSA-m9hp-7r99-94h5
- github.com/russellhaering/goxmldsig (Go) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-m9hp-7r99-94h5
Remediation
- Fix · CNA dex (dexidp) Fixed in 2.27.0
- Fix · GHSA-m9hp-7r99-94h5 github.com/dexidp/dex (Go) Fixed in 2.27.0 Advisory →
- Fix · GHSA-m9hp-7r99-94h5 github.com/russellhaering/goxmldsig (Go) Fixed in 1.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26290
- 2026-10-03 Alias added: GHSA-m9hp-7r99-94h5
References
Advisory 8
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
- https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
- https://github.com/dexidp/dex/releases/tag/v2.27.0
- https://nvd.nist.gov/vuln/detail/CVE-2020-26290
More backstage Dex vulnerabilities
- TI-2022-18601 OAuth authorization code exposure in Dex CVSS 3.1CRITICAL 9.3
- TI-2024-15675 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers CVSS 3.1HIGH 7.5
- TI-2020-16917 Authentication bypass by spoofing in dexidp/dex CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-26290 · CVE Program
- CVE-2020-26290 · NVD
- FIRST EPSS
- GHSA-m9hp-7r99-94h5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences