Dex: Token-exchange endpoint is missing AllowedConnectors enforcement in github.com/dexidp/dex

Description

References

• dexidp/dex security advisory · ADVISORY
• dexidp/dex commit 204dbb2 · FIX

Weitere Schwachstellen in github.com/dexidp/dex

• GHSA-7qjx-gp9h-65qjHOCH 8.7Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
• CVE-2024-23656HOCH 7.5Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 an…
• CVE-2022-39222MITTEL 6.5Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extens…
• CVE-2020-26290KRITISCH 9.6Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impa…