Skip to content

Product

ory github.com/ory/hydra vulnerabilities

3 published CVES affecting ory github.com/ory/hydra, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest ory github.com/ory/hydra CVEs

Newest publication first

  1. CVE-2026-33504 Ory Hydra has a SQL injection via forged pagination tokens

    Published
    HighCVSS 7.2 EPSS 0.37%

    Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation. Pag...

  2. CVE-2020-5300 Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra

    Published
    MediumCVSS 5.3 EPSS 1.0%

    In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion jti: "A unique identifier for the token,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.