Read the docs
TI-2022-18601 Aliases CVE-2022-39222GHSA-vh7g-p26c-j2cw

OAuth authorization code exposure in Dex

Priority HIGH 75CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-862.

Summary

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01584 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed dex (dexidp): 2.35.0github.com/dexidp/dex (Go): 2.35.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagedexbefore 2.35.02.35.0Patch availableCNA
—github.com/dexidp/dex (Go)before 2.35.02.35.0Patch availableGHSA-vh7g-p26c-j2cw
  • dex Vendorbackstage Affected before 2.35.0 Fixed in 2.35.0 Patch available CNA
  • github.com/dexidp/dex (Go) Vendor— Affected before 2.35.0 Fixed in 2.35.0 Patch available GHSA-vh7g-p26c-j2cw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:dex:*:*:*:*:*:*:*:*before 2.35.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:dex:*:*:*:*:*:*:*:* Versions before 2.35.0 Vulnerable ·backstage

Remediation

  • Fix · CNA dex (dexidp) Fixed in 2.35.0
  • Fix · GHSA-vh7g-p26c-j2cw github.com/dexidp/dex (Go) Fixed in 2.35.0 Advisory →

Red Hat 1 advisory

  • RHSA-2023:7725 Released 2023-12-11 · Red Hat rating Moderate
    RHACS 4.3 enhancement and security update
    • RHACS 4.3 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHACS 4.3 for RHEL 8Fixed RHSA-2023:7725
Not affected: 4 products
  • RHACS 4.3 for RHEL 8
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat OpenShift GitOps

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39222
  2. 2026-10-03 Alias added: GHSA-vh7g-p26c-j2cw

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-15675 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers CVSS 3.1HIGH 7.5
  • TI-2020-16917 Authentication bypass by spoofing in dexidp/dex CVSS 3.1CRITICAL 9.8
  • TI-2020-16111 Critical security issues in XML encoding in Dex CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences