[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fceI_XsZXb6iLeDjhnlgXbvlGUvQKuJPBIDRX_u6R4is":3,"g5a-risk:CVE-2020-26290":138},{"success":4,"data":5,"meta":136},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":48,"epssPercentile":28,"epssTimeSeries":49,"severity":50,"affectedProducts":51,"affectedProductsCount":57,"references":58,"referencesCount":88,"weaknesses":89,"weaknessesCount":57,"isActivelyExploited":98,"cisaInfo":28,"otxData":28,"relatedBlogPosts":99,"seoMetadata":100,"configurations":125,"relatedVendorCves":134,"notableEvents":135},"CVE-2020-26290","What is CVE-2020-26290?","Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).","Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leverag...","2020-12-28T20:15:12.493","2020-12-30T15:12:28.477",9.6,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":28,"CVSSMetricV2":38,"CVSSMetricV40":28},[16,31],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":26,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","NETWORK","LOW","NONE","REQUIRED","CHANGED","HIGH","CRITICAL",null,2.8,6,{"Source":32,"Type":33,"CVSSData":34,"ExploitabilityScore":29,"ImpactScore":37},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":35,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":23,"BaseScore":36,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":23,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N",9.3,5.8,[39],{"Source":17,"Type":18,"CVSSData":40,"BaseSeverity":43,"ExploitabilityScore":46,"ImpactScore":47,"ACInsufInfo":28,"ObtainAllPrivilege":28,"ObtainUserPrivilege":28,"ObtainOtherPrivilege":28,"UserInteractionRequired":4},{"Version":41,"VectorString":42,"AccessVector":21,"AccessComplexity":43,"Authentication":23,"ConfidentialityImpact":44,"IntegrityImpact":44,"AvailabilityImpact":44,"BaseScore":45,"BaseSeverity":28,"Exploitability":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"CollateralDamagePotential":28,"TargetDistribution":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"EnvironmentalScore":28},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:P\u002FI:P\u002FA:P","MEDIUM","PARTIAL",6.8,8.6,6.4,0.00989,[48,48,48,48,48,48,48],"Critical",[52],{"vendor":53,"product":54,"version":55,"criteria":56,"vulnerable":4},"linuxfoundation","dex","*","cpe:2.3:a:linuxfoundation:dex:*:*:*:*:*:*:*:*",1,[59,65,68,71,75,78,81,84],{"url":60,"source":61,"tags":62},"https:\u002F\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Fcommit\u002F324b1c886b407594196113a3dbddebe38eecd4e8","GitHub",[63,64],"Patch","Third Party Advisory",{"url":66,"source":61,"tags":67},"https:\u002F\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Freleases\u002Ftag\u002Fv2.27.0",[64],{"url":69,"source":61,"tags":70},"https:\u002F\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Fsecurity\u002Fadvisories\u002FGHSA-m9hp-7r99-94h5",[64],{"url":72,"source":61,"tags":73},"https:\u002F\u002Fgithub.com\u002Fmattermost\u002Fxml-roundtrip-validator\u002Fblob\u002Fmaster\u002Fadvisories\u002Funstable-attributes.md",[74,64],"Not Applicable",{"url":76,"source":61,"tags":77},"https:\u002F\u002Fgithub.com\u002Fmattermost\u002Fxml-roundtrip-validator\u002Fblob\u002Fmaster\u002Fadvisories\u002Funstable-directives.md",[74,64],{"url":79,"source":61,"tags":80},"https:\u002F\u002Fgithub.com\u002Fmattermost\u002Fxml-roundtrip-validator\u002Fblob\u002Fmaster\u002Fadvisories\u002Funstable-elements.md",[74,64],{"url":82,"source":61,"tags":83},"https:\u002F\u002Fgithub.com\u002Frussellhaering\u002Fgoxmldsig\u002Fsecurity\u002Fadvisories\u002FGHSA-q547-gmf8-8jr7",[74,64],{"url":85,"source":86,"tags":87},"https:\u002F\u002Fmattermost.com\u002Fblog\u002Fcoordinated-disclosure-go-xml-vulnerabilities\u002F","Mattermost",[74,64],8,[90],{"id":91,"name":92,"description":93,"extendedDescription":94,"status":95,"abstraction":96,"structure":97},"CWE-347","Improper Verification of Cryptographic Signature","The product does not verify, or incorrectly verifies, the cryptographic signature for data.","","Draft","Base","Simple",false,[],{"title":101,"metaDescription":102,"keywords":103,"canonicalUrl":104,"structuredData":105},"What is CVE-2020-26290? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-26290, a critical severity cyber security vulnerability from 2020. Dex is a federated OpenID Connect provider written in G...","CVE-2020-26290, CVE-2020-26290 vulnerability, CVE-2020-26290 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, linuxfoundation security, dex vulnerability","\u002Fwhat-is\u002Fcve-2020-26290",{"@context":106,"@type":107,"headline":101,"description":102,"datePublished":10,"dateModified":11,"author":108,"publisher":112,"about":116,"mainEntityOfPage":120,"articleSection":123,"keywords":124},"https:\u002F\u002Fschema.org","TechArticle",{"@type":109,"name":110,"url":111},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":109,"name":110,"url":111,"logo":113},{"@type":114,"url":115},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":117,"name":6,"description":118,"additionalType":119},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":121,"@id":122},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-26290","Cybersecurity","CVE-2020-26290, CVE-2020-26290 vulnerability, CVE-2020-26290 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[126],{"Operator":28,"Negate":28,"Nodes":127},[128],{"Operator":129,"Negate":28,"CPEMatch":130},"OR",[131],{"Vulnerable":4,"Criteria":56,"MatchCriteriaID":132,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":133,"VersionEndIncluding":28},"6DED3272-1D65-4A06-97D5-73FC7EE37516","2.27.0",[],[],{"lastModified":11,"cacheTime":137,"version":41},1792437361530,{"score":139,"band":140,"action":141,"scoredAt":142},54,"Medium","Plan remediation","2026-10-16T06:50:06.872852+00:00"]