CVE-2020-26290

CVE-2020-26290 is a critical vulnerability affecting Dex, an OpenID Connect provider, specifically impacting users leveraging its SAML connector. This flaw, present in versions prior to 2.27.0, allows for potential signature bypass due to XML encoding issues in the underlying Go library. With a CVSS score of 9.6 (CRITICAL), it presents a high-impact risk (confidentiality, integrity, availability) that can be exploited remotely with low attack complexity, requiring user interaction. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness among security researchers.