CVE-2024-39315

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the `/.pomerium` endpoint. Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner. Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided the application verifies the Pomerium JWT for each request, the connection between Pomerium and the application is secured by mTLS, or the connection between Pomerium and the application is otherwise secured at the network layer. The issue is patched in Pomerium v0.26.1. No known workarounds are available.

• CWE-201

• https://github.com/pomerium/pomerium/commit/4c7c4320afb2ced70ba19b46de1ac4383f3daa48Patch
• https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637vVendor Advisory
• https://github.com/pomerium/pomerium/commit/4c7c4320afb2ced70ba19b46de1ac4383f3daa48Patch
• https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637vVendor Advisory

Published

Jul 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3931A vulnerability was found in Totara LMS up to 18.7. It has b…5.4
• CVE-2024-39310The Basil recipe theme for WordPress is vulnerable to Persis…5.4
• CVE-2024-39311Publify is a self hosted Web publishing platform on Rails. P…5.4
• CVE-2024-39312Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-39313toy-blog is a headless content management system implementat…5.3
• CVE-2024-39314toy-blog is a headless content management system implementat…4.7
• CVE-2024-39316Rack is a modular Ruby web server interface. Starting in ver…6.5
• CVE-2024-39317Wagtail is an open source content management system built on…4.9
• CVE-2024-39318The Ibexa Admin UI Bundle contains all the necessary parts t…5.4
• CVE-2024-39319aimeos/ai-controller-frontend is the Aimeos frontend control…5.3
• CVE-2024-3932A vulnerability classified as problematic has been found in …3.1
• CVE-2024-39320Discourse is an open source discussion platform. Prior to 3.…6.1