Skip to content
OpenAdvisories

Package · Go

github.com/dexidp/dex

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    GHSA-7qjx-gp9h-65qj

    Dex: Token-exchange endpoint is missing AllowedConnectors enforcement

    ## Summary `server/handlers.go::handleTokenExchange` (lines 1804-1893) does not call `isConnectorAllowed(client.AllowedConnectors, connID)` before issuing tokens, while sibling handlers do. This is a per-client connector ACL gap on the token-exchange endpoint…

    github.com/dexidp/dex Go
  • High 7.5
    CVE-2024-23656

    Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

    Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored …

    dexidp dex github.com/dexidp/dex Go