CVE-2020-27847 Auth bypass in dexidp/dex
Attackers can bypass SAML authentication in the Dex library, compromising confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27847?
CVE-2020-27847 is a critical authentication bypass vulnerability in dexidp/dex, published on 28 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
Weakness: CWE-228
Which versions are affected by CVE-2020-27847?
It affects 1 product.
Products include Linuxfoundation Dex.
How do I fix CVE-2020-27847?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-27847 being exploited?
There is no known exploitation of CVE-2020-27847 in the wild and no public exploit code.