CVE-2021-29651
JWT leak via Open Redirect in Programmatic access
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
- Record
CVE-2021-29651- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
- Record
CVE-2021-29651- Updated
- 2026-11-02
EUVDEUVD-2021-0913 No score
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
- Record
EUVD-2021-0913- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-35vc-w93w-75c2
JWT leak via Open Redirect in Programmatic access
Impact
Using programmatic access on protected sites, one can get a signed login URL with pomerium_redirect_uri set to an arbitrary URL. Then, if the user has already logged into Pomerium, they will be redirected to the specified pomerium_redirect_uri with a JWT attached. This allows an outside attacker to get a signed login URL that, upon visiting it, will redirect a victim to the attacker’s site. This creates an issue of Open Redirect and, more seriously, JWT leakage.
With a leaked JWT, the attacker will be able to unveil the victim’s identity (.e.g. email address) by supplying the JWT to the authenticate service or verify.pomerium.com. In addition, if an application integrating Pomerium only verifies the iss claim and others but not the aud claim, the attacker will be able to access it as the victim.
Specific Go Packages Affected
github.com/pomerium/pomerium/proxy
Patches
Patched in Pomerium v0.13.4
For more information
If you have any questions or comments about this advisory
- Open an issue in pomerium
- Email us at [email protected]
- Record
GHSA-35vc-w93w-75c2- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-200, CWE-601
- Updated
- 2026-11-02
OSV
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
- Record
CVE-2021-29651- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-35vc-w93w-75c2
JWT leak via Open Redirect in Programmatic access
Impact
Using programmatic access on protected sites, one can get a signed login URL with pomerium_redirect_uri set to an arbitrary URL. Then, if the user has already logged into Pomerium, they will be redirected to the specified pomerium_redirect_uri with a JWT attached. This allows an outside attacker to get a signed login URL that, upon visiting it, will redirect a victim to the attacker’s site. This creates an issue of Open Redirect and, more seriously, JWT leakage.
With a leaked JWT, the attacker will be able to unveil the victim’s identity (.e.g. email address) by supplying the JWT to the authenticate service or verify.pomerium.com. In addition, if an application integrating Pomerium only verifies the iss claim and others but not the aud claim, the attacker will be able to access it as the victim.
Specific Go Packages Affected
github.com/pomerium/pomerium/proxy
Patches
Patched in Pomerium v0.13.4
For more information
If you have any questions or comments about this advisory
- Open an issue in pomerium
- Email us at [email protected]
- Record
GHSA-35vc-w93w-75c2- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-200, CWE-601
- Updated
- 2026-11-02
OSVGO-2022-0783 No score
JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium
JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium
- Record
GO-2022-0783- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/pomerium/pomeriumGo |
before 0.13.4 | 0.13.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29651 is a medium vulnerability (CVSS 6.1) in Pomerium, published April 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in github.com/pomerium/pomerium 0.13.4.