Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dexidp/dex
master @ db855ad
46
Fixes
6
CVEs
CRITICAL
Peak severity
18.2%
Coverage
Highlights
Auth Bypass: 29 prior fixes. Scrutinize any change in this area.
server: most-fixed (10 issues). Treat as high-risk during review.
31 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inversion of cryptographic check parameter order in bcrypt.CompareHashAndPassword compromised password validation logic entirely. All security-sensitive comparisons must verify argument order.
Auth Bypass: Vulnerabilities in the SAML response processing allowed signature validation bypasses by failing to strip unverified child elements and neglecting namespace-aware element isolation. This is tracked under CVE-2020-27847 and CVE-2020-26290.
LDAP Injection: User input strings (username and password) were historically interpolated directly into LDAP queries, allowing query structural manipulation. Safe integration requires strict usage of ldap.EscapeFilter.