High severity · published Nov 5, 2021
CVE-2021-41230
OIDC claims not updated from Identity Provider in Pomerium
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
pomerium · pomerium
>= 0.14.0, < 0.15.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41230
Patch
https://github.com/pomerium/pomerium/pull/2724
Third Party Advisory
https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfg
More from pomerium
9.8
CVE-2023-33189
Incorrect Authorization with specially crafted requests
9.1
CVE-2022-24797
Exposure of Sensitive Information in Pomerium
8.6
CVE-2021-39206
Incorrect Authorization with specially crafted requests
8.6
CVE-2021-39162
Incorrect handling of H2 GOAWAY + SETTINGS frames
7.5
CVE-2026-50285
Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback