CVE-2021-29651

CVE-2021-29651 affects Pomerium up to version 0.13.4, with an Open Redirect in the programmatic login flow. A signed login URL can redirect to an attacker‑controlled URL via the pomerium_redirect_uri, potentially enabling JWT leakage if the victim already logged in. The issue is described as an o...