CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).

• CWE-347

• https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8Patch, Third Party Advisory
• https://github.com/dexidp/dex/releases/tag/v2.27.0Third Party Advisory
• https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5Third Party Advisory
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.mdNot Applicable, Third Party Advisory
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.mdNot Applicable, Third Party Advisory
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.mdNot Applicable, Third Party Advisory
• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7Not Applicable, Third Party Advisory
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/Not Applicable, Third Party Advisory
• https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8Patch, Third Party Advisory
• https://github.com/dexidp/dex/releases/tag/v2.27.0Third Party Advisory
• https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5Third Party Advisory
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.mdNot Applicable, Third Party Advisory
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.mdNot Applicable, Third Party Advisory
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.mdNot Applicable, Third Party Advisory
• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7Not Applicable, Third Party Advisory
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/Not Applicable, Third Party Advisory

Published

Dec 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26285OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26286HedgeDoc is a collaborative platform for writing and sharing…7.5
• CVE-2020-26287HedgeDoc is a collaborative platform for writing and sharing…8.7
• CVE-2020-26288Parse Server is an open source backend that can be deployed …6.5
• CVE-2020-26289date-and-time is an npm package for manipulating date and ti…7.5
• CVE-2020-2629Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26291URI.js is a javascript URL mutation library (npm package uri…6.5
• CVE-2020-26292Creeper is an experimental dynamic, interpreted language. Th…9.8
• CVE-2020-26293HtmlSanitizer is a .NET library for cleaning HTML fragments …6.1
• CVE-2020-26294Vela is a Pipeline Automation (CI/CD) framework built on Lin…5.3
• CVE-2020-26295OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26296Vega is a visualization grammar, a declarative format for cr…8.7