{"vulnerability": "GHSA-7QJX-GP9H-65QJ", "sightings": [{"uuid": "decc7775-e8d3-43a7-875d-5ddb3ce3f5a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7QJX-GP9H-65QJ", "type": "seen", "source": "https://gist.github.com/alon710/663cf40e16b6dd064b1d29749e82124d", "content": "# GHSA-7QJX-GP9H-65QJ: GHSA-7QJX-GP9H-65QJ: Improper Authorization in Dex Token Exchange\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-06-09\n> **Full Report:** https://cvereports.com/reports/GHSA-7QJX-GP9H-65QJ\n\n## Summary\nAn improper authorization vulnerability in the unreleased development master branch of Dex allows clients to bypass the AllowedConnectors access control list using the token-exchange endpoint.\n\n## TL;DR\nDex token-exchange endpoint fails to validate AllowedConnectors, allowing attackers with a compromised client secret to escalate privileges via unauthorized identity providers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.7 (High)\n- **Impact**: Privilege Escalation\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Dex (OIDC & OAuth 2.0 Provider) Development builds on Master branch\n- **Dex**: Master branch (>= f80a89d and < 204dbb2e3ff7) (Fixed in: `Master branch commit 204dbb2e3ff7692af3b7ca4362b1ee46fb43c227`)\n\n## Mitigation\n\n- Upgrade to master branch head containing commit 204dbb2e3ff7692af3b7ca4362b1ee46fb43c227 or stick to stable tagged releases.\n- Regularly rotate client secrets to minimize exposure risks.\n- Implement Web Application Firewall (WAF) rules to filter or drop token exchange requests if the feature is not strictly required.\n\n**Remediation Steps:**\n1. Identify if your Dex instance runs a development build based on the master branch post-March 2026.\n2. Apply the code patch by rebuilding Dex with commit 204dbb2e3ff7692af3b7ca4362b1ee46fb43c227 or migrating back to stable release v2.45.1.\n3. Validate client configurations and revoke compromised client secrets immediately.\n\n## References\n\n- [GitHub Advisory Database entry for GHSA-7QJX-GP9H-65QJ](https://github.com/advisories/GHSA-7QJX-GP9H-65QJ)\n- [Dex Security Advisory](https://github.com/dexidp/dex/security/advisories/GHSA-7qjx-gp9h-65qj)\n- [Fix Commit in Dex](https://github.com/dexidp/dex/commit/204dbb2e3ff7692af3b7ca4362b1ee46fb43c227)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7QJX-GP9H-65QJ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-09T22:11:08.000000Z"}]}