Impact Some API endpoints under /.pomerium/ do not verify parameters with pomeriumsignature. This could allow modifying parameters intended to be trusted to Pomerium.

The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass.

Specific Go Packages Affected github.com/pomerium/pomerium/authenticate

Patches Patched in v0.13.4

For more information If you have any questions or comments about this advisory Open an issue in pomerium Email us at security@pomerium.com