CVE-2020-27846

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

• CWE-115

• https://bugzilla.redhat.com/show_bug.cgi?id=1907670Issue Tracking, Patch, Third Party Advisory
• https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9Third Party Advisory
• https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/Exploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210205-0002/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1907670Issue Tracking, Patch, Third Party Advisory
• https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9Third Party Advisory
• https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/Exploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210205-0002/Third Party Advisory

Published

Dec 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27840A flaw was found in samba. Spaces used in a string around a …7.5
• CVE-2020-27841There's a flaw in openjpeg in versions prior to 2.4.0 in src…5.5
• CVE-2020-27842There's a flaw in openjpeg's t2 encoder in versions prior to…5.5
• CVE-2020-27843A flaw was found in OpenJPEG in versions prior to 2.4.0. Thi…5.5
• CVE-2020-27844A flaw was found in openjpeg's src/lib/openjp2/t2.c in versi…7.8
• CVE-2020-27845There's a flaw in src/lib/openjp2/pi.c of openjpeg in versio…5.5
• CVE-2020-27847A vulnerability exists in the SAML connector of the github.c…9.8
• CVE-2020-27848dotCMS before 20.10.1 allows SQL injection, as demonstrated …8.8
• CVE-2020-2785Vulnerability in the Oracle Outside In Technology product of…7.3
• CVE-2020-27850A stored Cross-Site Scripting (XSS) vulnerability in forms i…4.8
• CVE-2020-27851Multiple stored HTML injection vulnerabilities in the "poll"…5.4
• CVE-2020-27852A stored Cross-Site Scripting (XSS) vulnerability in the sur…5.4