Executive brief
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
Affected products
- Go github.com/dexidp/dex
Junglewise Threat Intelligence
CVE-2022-39222: Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
CVE-2022-39222 · Severity: low · CVSS 3.1 · Published 2022-10-03
Technologies: github.com/dexidp/dex (Go). Vendors: Go.
Related threats
- GO-2026-5231 - Dex: Token-exchange endpoint is missing AllowedConnectors enforcement in github.com/dexidp/dex
- Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
- Dex improper authorization in token-exchange endpoint
- GO-2024-2476 - Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex
- Critical security issues in XML encoding in github.com/dexidp/dex