pomerium_signature is not verified in middleware in github.com/pomerium/pomerium

GHSA-fv82-r8qv-ch4v · CVE-2021-29652 · GO-2022-0827

Published May 21, 2021 · Modified Jul 8, 2026

Description

Impact

Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium.

The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass.

Specific Go Packages Affected

github.com/pomerium/pomerium/authenticate

Patches

Patched in v0.13.4

For more information

If you have any questions or comments about this advisory

Open an issue in pomerium
Email us at security@pomerium.com

References

WEB https://github.com/pomerium/pomerium/security/advisories/GHSA-fv82-r8qv-ch4v
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-29652
WEB https://github.com/pomerium/pomerium/pull/2048

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes