CVE-2021-22565: Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
Summary
CVE-2021-22565: Impact Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID. Affects github.com/google/exposure-notifications-verification-server versions < 1.1.2. Fixed in 1.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/google/exposure-notifications-verification-server package is written in Go and is used for managing verification codes in the exposure notifications system. It provides functionality for expiring verification codes and belongs to the Go ecosystem. The package is vulnerable to an insufficient granularity of access control issue.
Vulnerability Detail
The vulnerability allows users or API keys with permission to expire verification codes to potentially expire codes that belong to another realm if they guess the UUID. This can lead to unauthorized access to verification codes and potential misuse of the exposure notifications system. The vulnerability has a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
How To Fix
Latest published version: v1.17.0 as of 23 Oct 2026
go get github.com/google/exposure-notifications-verification-server@v1.17.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.2
This is the first release that contains the fix.
go get github.com/google/exposure-notifications-verification-server@v1.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. However, it is important to note that the vulnerability requires guessing the UUID of verification codes, which are already valid for a very short period of time and rotate frequently. Therefore, the risk of exploitation is reduced.
Conclusion
The github.com/google/exposure-notifications-verification-server package is vulnerable to an insufficient granularity of access control issue, which can lead to unauthorized access to verification codes in the exposure notifications system. It is recommended to update to version 1.1.2 or later of the package to fix the vulnerability. There are no known workarounds, and the risk of exploitation is reduced due to the short validity period and frequent rotation of verification codes. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/google/exposure-notifications-verification-server →
FAQ
The vulnerability allows unauthorized access to verification codes in the exposure notifications system, potentially leading to misuse of the system.
To fix the vulnerability, update to version 1.1.2 or later of the github.com/google/exposure-notifications-verification-server package.
There are no known workarounds for this vulnerability, but the risk of exploitation is reduced due to the short validity period and frequent rotation of verification codes.
There are no indications that this vulnerability has been exploited in the wild.
For more information, you can contact exposure-notifications-feedback@google.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/exposure-notifications-verification-server.
