Read the docs

ory

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

ory records in CISA KEV

No ory vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Fosite 4 records LOW Oathkeeper 4 records MEDIUM Hydra 3 records LOW Keto 1 record LOW Kratos 1 record LOW Polis 1 record LOW

Records

15 records

TI-2026-25890 CVE-2026-33494 · GHSA-p224-6x5r-fjpm

Ory Oathkeeper has a path traversal authorization bypass

Priority MEDIUM 49

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00528 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084758-8e0002140491 CWE-23
TI-2026-25902 CVE-2026-33506

DOM-Based XSS in Ory Polis Login Page

Priority LOW 39

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00474 Published 2026-03-26 Fixed in 26.2.0 CWE-601
TI-2020-11995 CVE-2020-15223 · GHSA-7mqr-2v3q-v2wm

Ignored storage errors on token revokation in ORY Fosite

Priority LOW 38

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.01588 Published 2020-09-24 Fixed in 0.34.0 CWE-755
TI-2020-11994 CVE-2020-15222 · GHSA-v3q9-2p3m-7g43

Replay of private_key_jwt possible in ORY Fosite

Priority LOW 37

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00867 Published 2020-09-24 Fixed in 0.31.0 CWE-287
TI-2026-25892 CVE-2026-33496 · GHSA-4mq7-pvjg-xp2r

Ory Oathkeeper has an authentication bypass by cache key confusion

Priority LOW 35

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00384 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084801-198a2bc82a99 CWE-1289
TI-2026-25891 CVE-2026-33495 · GHSA-vhr5-ggp3-qq85

Ory Oathkeeper has an authentication bypass by usage of untrusted header

Priority LOW 34

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00243 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084810-e9acca14a04d CWE-862
TI-2026-25901 CVE-2026-33505 · GHSA-c38g-mx2c-9wf2

Ory Keto has a SQL injection via forged pagination tokens

Priority LOW 33

Ory Keto is am open source authorization server for managing permissions at scale.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00233 Published 2026-03-26 Fixed in 26.2.0, 0.14.1-0.20260320140104-e4393662cd2e CWE-89
TI-2026-25899 CVE-2026-33503 · GHSA-hgx2-28f8-6g2r

Ory Kratos has a SQL injection via forged pagination tokens

Priority LOW 33

Ory Kratos is an identity, user management and authentication system for cloud services.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00262 Published 2026-03-26 Fixed in 26.2.0, 1.3.1-0.20260320110106-9d7085948039 CWE-89
TI-2020-12006 CVE-2020-15234 · GHSA-grfp-q2mm-hfp6

Redirect URL matching ignores character casing

Priority LOW 29

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00841 Published 2020-10-02 Fixed in 0.34.1 CWE-20
TI-2020-04356 CVE-2020-5300 · GHSA-3p3g-vpw6-4w66

Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra

Priority LOW 28

In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the followi…

CVSS 3.1MEDIUM 5.8 Network Low privileges User interaction EPSS 0.01028 Published 2020-04-06 Fixed in 1.4.0+oryOS.17, 1.4.0 CWE-294
Open these records in search →