Executive brief
Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
Affected products
- Go github.com/dexidp/dex
Junglewise Threat Intelligence
Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
Severity: low · CVSS 3.1 · Published 2026-06-09
Technologies: github.com/dexidp/dex (Go). Vendors: Go.
Related threats
- GO-2026-5231 - Dex: Token-exchange endpoint is missing AllowedConnectors enforcement in github.com/dexidp/dex
- Dex improper authorization in token-exchange endpoint
- GO-2024-2476 - Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex
- Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
- Critical security issues in XML encoding in github.com/dexidp/dex