CVE-2020-27846

highpriority · track · 41EPSS 0.049 · 92 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
4.93% (92nd) EPSS
CVSS 10 · high
Is it mine?
28 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · osv · balluff_psirt

EPSS · scored 2026-10-27

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

10.0
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 10 · impact 10
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Balluff PSIRT
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-115USCWE-115USCWE-115USCWE-115USCWE-287US
04

affected products (28)

Products and version ranges known to be affected.

showing 20 of 28
05

advisories (5)

Vendor and ecosystem advisories describing this.

  • RHSA-2021:1859Red Hat Security Advisory: grafana security, bug fix, and enhancement update2021-05-18csaf · redhat_csafUS

    An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • VDE-2026-049Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-012026-06-30csaf · balluff_psirtDE

    Security advisory for Balluff BNI EGW-720-007-K095 and BAV MA-NC-00025-01 firmware versions prior to 2.4.1. This advisory covers multiple vulnerabilities affecting software components used by the device firmware.

  • GHSA-4hq8-gmxx-h6w9XML Processing error in github.com/crewjam/saml2021-06-23ghsa · osvUS

    ### Impact There are three vulnerabilities in the go `encoding/xml` package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see [xml-roundtrip-validator](https://github.com/mattermost/xml-roundtrip-validator) ### Patches In version 0.4.3, all XML input is validated prior to being parsed.

  • BIT-grafana-2020-278462024-03-06vendor · osvUS

    A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

  • GO-2021-0058Signature validation bypass due to XML processing error in github.com/crewjam/saml2021-04-14vendor · osvUS

    Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed.

06

also known as (6)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvballuff_psirtnvdredhat_csafNVDCVE.orgMITRE
published 2020-12-21modified 2026-06-17
08

references (27)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan