CVE-2022-39222

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-200
• CWE-862

• https://github.com/dexidp/dex/commit/49471b14c8080ddb034d4855841123d378b7a634Patch, Third Party Advisory
• https://github.com/dexidp/dex/security/advisories/GHSA-vh7g-p26c-j2cwExploit, Third Party Advisory
• https://github.com/dexidp/dex/commit/49471b14c8080ddb034d4855841123d378b7a634Patch, Third Party Advisory
• https://github.com/dexidp/dex/security/advisories/GHSA-vh7g-p26c-j2cwExploit, Third Party Advisory

Published

Oct 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39217some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) i…9.8
• CVE-2022-39218The JS Compute Runtime for Fastly's Compute@Edge platform pr…7.5
• CVE-2022-39219Bifrost is a middleware package which can synchronize MySQL/…6.5
• CVE-2022-3922The Broken Link Checker WordPress plugin before 1.11.20 does…4.8
• CVE-2022-39220SFTPGo is an SFTP server written in Go. Versions prior to 2.…6.1
• CVE-2022-39221McWebserver mod runs a simple HTTP server alongside the Mine…7.5
• CVE-2022-39224Arr-pm is an RPM reader/writer library written in Ruby. Vers…7.8
• CVE-2022-39225Parse Server is an open source backend that can be deployed …3.1
• CVE-2022-39226Discourse is an open source discussion platform. In versions…4.3
• CVE-2022-39227python-jwt is a module for generating and verifying JSON Web…9.1
• CVE-2022-39228vantage6 is a privacy preserving federated learning infrastr…6.5
• CVE-2022-39229Grafana is an open source data visualization platform for me…4.3