{"action":"Upgrade github.com/dexidp/dex to 2.35.0 or later.","affected":[{"fixed":"2.35.0","introduced":"0"}],"component":"github.com/dexidp/dex","cve_ids":["CVE-2022-39222"],"ecosystem":"Go","epss":0.01584,"exploited":false,"fixed_versions":["2.35.0"],"ghsa_id":"GHSA-vh7g-p26c-j2cw","id":"tcs_01M5KFP6SR1VN43E9C9GJJ739A","modified_at":"2026-09-10T03:49:46.691834039Z","published_at":"2022-10-03T19:12:03Z","references":["https://osv.dev/vulnerability/GHSA-vh7g-p26c-j2cw","https://github.com/dexidp/dex/security/advisories/GHSA-vh7g-p26c-j2cw","https://nvd.nist.gov/vuln/detail/CVE-2022-39222","https://github.com/dexidp/dex/commit/49471b14c8080ddb034d4855841123d378b7a634","https://github.com/dexidp/dex","https://github.com/dexidp/dex/releases/tag/v2.35.0"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-vh7g-p26c-j2cw","url":"https://osv.dev/vulnerability/GHSA-vh7g-p26c-j2cw"}],"summary":"Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code"}