Authentication bypass by spoofing in dexidp/dex
Priority MEDIUM 45CWE-228Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-290.
Summary
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
Why it matters now
EPSS 0.01718 77th percentileScored 2026-11-07
Fix Partial github.com/dexidp/dex (Go): 2.27.0Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | dexidp/dex | dex 2.27.0 | — | No fix listed | CNA |
| — | github.com/dexidp/dex (Go) | before 2.27.0 | 2.27.0 | Patch available | GHSA-2x32-jm95-2cpx |
- dexidp/dex Vendor— Affected dex 2.27.0 Fixed in — No fix listed CNA
- github.com/dexidp/dex (Go) Vendor— Affected before 2.27.0 Fixed in 2.27.0 Patch available GHSA-2x32-jm95-2cpx
Remediation
- Fix · GHSA-2x32-jm95-2cpx github.com/dexidp/dex (Go) Fixed in 2.27.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27847
- 2026-10-03 Alias added: GHSA-2x32-jm95-2cpx
References
Advisory 3
More backstage Dex vulnerabilities
- TI-2022-18601 OAuth authorization code exposure in Dex CVSS 3.1CRITICAL 9.3
- TI-2024-15675 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers CVSS 3.1HIGH 7.5
- TI-2020-16111 Critical security issues in XML encoding in Dex CVSS 3.1CRITICAL 9.6
Sources
- CVE-2020-27847 · CVE Program
- CVE-2020-27847 · NVD
- FIRST EPSS
- GHSA-2x32-jm95-2cpx · GitHub Advisory Database · CC BY 4.0
- CVE-2020-27847 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences