Read the docs
TI-2021-18069 Aliases CVE-2021-41230GHSA-j6wp-3859-vxfg

OIDC claims not updated from Identity Provider in Pomerium

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.

Why it matters now

EPSS 0.0086 58th percentileScored 2026-11-07
Fix Fixed pomerium (pomerium): 0.15.6github.com/pomerium/pomerium (Go): 0.15.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pomeriumpomerium0.14.0 to before 0.15.60.15.6Patch availableCNA
—github.com/pomerium/pomerium (Go)0.14.0 to before 0.15.60.15.6Patch availableGHSA-j6wp-3859-vxfg
  • pomerium Vendorpomerium Affected 0.14.0 to before 0.15.6 Fixed in 0.15.6 Patch available CNA
  • github.com/pomerium/pomerium (Go) Vendor— Affected 0.14.0 to before 0.15.6 Fixed in 0.15.6 Patch available GHSA-j6wp-3859-vxfg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*0.14.0 to before 0.15.6Vulnerablepomerium
  • cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:* Versions 0.14.0 to before 0.15.6 Vulnerable ·pomerium

Remediation

  • Fix · CNA pomerium (pomerium) Fixed in 0.15.6
  • Fix · GHSA-j6wp-3859-vxfg github.com/pomerium/pomerium (Go) Fixed in 0.15.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41230
  2. 2026-10-03 Alias added: GHSA-j6wp-3859-vxfg

References

Patch 1

Advisory 2

Other 3

  • TI-2023-16366 Incorrect Authorization with specially crafted requests CVSS 3.1CRITICAL 10.0
  • TI-2022-08610 Exposure of Sensitive Information in Pomerium CVSS 3.1CRITICAL 9.1
  • TI-2021-16548 Incorrect handling of H2 GOAWAY + SETTINGS frames CVSS 3.1HIGH 8.6
  • TI-2021-16591 Incorrect Authorization with specially crafted requests CVSS 3.1HIGH 8.6
  • TI-2021-16589 Excessive CPU usage in Pomerium CVSS 3.1HIGH 7.5
  • TI-2024-26271 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences