CVE-2020-27847

Name of the Vulnerable Software and Affected Versions: dex versions prior to 2.27.0

Description: A flaw in the SAML connector of the dex library allows an attacker to bypass SAML authentication, posing a threat to confidentiality, integrity, and system availability. This issue arises due to the behavior of encoding/xml, where a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, making an unsigned document appear signed.

Recommendations: For versions prior to 2.27.0, update to version 2.27.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SAML connector until a patch is applied. Avoid using the SAML connector for authentication until the issue is resolved.