Skip to content
OpenAdvisories

Package · Go

github.com/ory/hydra

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.8
    CVE-2020-5300

    Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra

    In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique ide…

    ory hydra github.com/ory/hydra Go
  • Medium 6.1
    CVE-2019-8400

    Hydra has Reflected XSS via error_hint parameter

    ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.

    github.com/ory/hydra Go