How severe is CVE-2020-27847?

CVE-2020-27847 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-27847 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-27847?

CVE-2020-27847 affects Linuxfoundation Dex. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-27847?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2020-27847 published?

CVE-2020-27847 was published on 2021-05-28 and last updated on 2026-06-17.

CVE-2020-27847

CVE-2020-27847 is a critical-severity vulnerability in Linuxfoundation Dex with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-228.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (75th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-228
Affected product: Linuxfoundation Dex
Published: 2021-05-28
Last modified: 2026-06-17

Description

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

Frequently asked questions

What is CVE-2020-27847?: A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
How severe is CVE-2020-27847?: CVE-2020-27847 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-27847 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-27847?: CVE-2020-27847 affects Linuxfoundation Dex. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-27847?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2020-27847 published?: CVE-2020-27847 was published on 2021-05-28 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:linuxfoundation:dex:*:*:*:*:*:*:*:*

More vulnerabilities in Linuxfoundation Dex

CVE-2022-39222 — Critical (CVSS 9.3): Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public…
CVE-2020-26290 — Critical (CVSS 9.3): Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of…
CVE-2024-23656 — High (CVSS 7.5): Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS…

All CVEs affecting Linuxfoundation Dex →

Other CWE-228 vulnerabilities

CVE-2026-20125 — High (CVSS 7.7): A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an…
CVE-2026-42100 — High (CVSS 7.5): Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to…
CVE-2026-34232 — High (CVSS 7.5): Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the…
CVE-2025-0343 — High (CVSS 7.5): Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in…
CVE-2024-21612 — High (CVSS 7.5): An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of…
CVE-2021-38443 — Medium (CVSS 6.6): Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write…

Browse all CWE-228 vulnerabilities →