https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 06:16:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-31625 EUVD-2026-31625 https://cve.radiocsirt.org/vuln/euvd-2026-31625 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41230 <p>Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user&#39;s claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.</p> <p>Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user&#39;s claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-41230 https://cve.radiocsirt.org/vuln/ghsa-j6wp-3859-vxfg <p><strong>Affected:</strong> Go: github.com/pomerium/pomerium</p> <p>### Impact Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using [`allowed_idp_claims`](https://www.pomerium.com/reference/#allowed-idp-claims) as part of policy. If using `allowed_idp_claims` and a user&#39;s claims are changed, Pomerium can make incorrect authorization decisions.</p> <p>### Patches v0.15.6</p> <p>### Workarounds - Clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated</p> <p>### References https://github.com/pomerium/pomerium/pull/2724</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [Pomerium](https://github.com/pomerium/pomerium) * Email us at [security@pomerium.com](mailto:security@pomerium.com)</p> <p><strong>Affected:</strong> Go: github.com/pomerium/pomerium</p> <p>### Impact Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using [`allowed_idp_claims`](https://www.pomerium.com/reference/#allowed-idp-claims) as part of policy. If using `allowed_idp_claims` and a user&#39;s claims are changed, Pomerium can make incorrect authorization decisions.</p> <p>### Patches v0.15.6</p> <p>### Workarounds - Clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated</p> <p>### References https://github.com/pomerium/pomerium/pull/2724</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [Pomerium](https://github.com/pomerium/pomerium) * Email us at [security@pomerium.com](mailto:security@pomerium.com)</p> https://cve.radiocsirt.org/vuln/ghsa-j6wp-3859-vxfg https://cve.radiocsirt.org/vuln/gsd-2021-41230 gsd-2021-41230 https://cve.radiocsirt.org/vuln/gsd-2021-41230