hashicorp-forge vulnerabilities

Products

• github.com/hashicorp-forge/hermes 1

Latest hashicorp-forge CVEs

Newest publication first

1. CVE-2025-1293 HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass

   Published 2025-02-20

   High·CVSS 8.2 EPSS 0.35%

   Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.