---
id: CVE-2020-26290
aliases:
  - GHSA-2x32-jm95-2cpx
  - CVE-2020-27847
  - GHSA-m9hp-7r99-94h5
title: Authentication Bypass in dex
summary: Authentication Bypass in dex
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: dexidp
product: github.com/dexidp/dex
ecosystem: go
affected:
  - github.com/dexidp/dex < 2.27.0
patched:
  - github.com/dexidp/dex 2.27.0
published: '2021-12-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:10.072897849Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2x32-jm95-2cpx'
references:
  - url: 'https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-27847'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1907732'
  - url: 'https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities'
tags:
  - osv
  - go
epss: 0.00989
epssPercentile: 0.60874
ingestedAt: '2026-07-09T18:56:35.452Z'
---

## Overview

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

## Affected packages

- `github.com/dexidp/dex < 2.27.0`

## Remediation

Upgrade to a patched release:

- `github.com/dexidp/dex 2.27.0`