Skip to content
OpenAdvisories

Package · Go

github.com/dexidp/dex

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.7
    GHSA-7qjx-gp9h-65qj

    Dex: Token-exchange endpoint is missing AllowedConnectors enforcement

    ## Summary `server/handlers.go::handleTokenExchange` (lines 1804-1893) does not call `isConnectorAllowed(client.AllowedConnectors, connID)` before issuing tokens, while sibling handlers do. This is a per-client connector ACL gap on the token-exchange endpoint…

    github.com/dexidp/dex Go
  • High 7.5
    CVE-2024-23656

    Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

    Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored …

    dexidp dex github.com/dexidp/dex Go
  • Critical 9.3
    CVE-2022-39222

    OAuth authorization code exposure in Dex

    Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a v…

    dexidp dex github.com/dexidp/dex Go
  • Critical 9.3
    CVE-2020-26290

    Critical security issues in XML encoding in Dex

    Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML …

    dexidp dex github.com/russellhaering/goxmldsig github.com/dexidp/dex Go