CVE-2021-22565: Insufficient Granularity of Access Control in GAEN Notification Server

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-09 · updated 2026-06-17
Weakness: CWE-284

Description

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

Affected products

Google LLC Google Exposure-notifications-verification-server: before 1.1.2 — fixed in 1.1.2

How to fix

Upgrade to a fixed version: Google LLC Google Exposure-notifications-verification-server 1.1.2. Check the vendor advisory for mitigations.

References

https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2
https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v
https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2
https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v

Get alerted when CVE-2021-22565 or the next vulnerability affects your stack