Read the docs

ory

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

ory records in CISA KEV

No ory vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Fosite 4 records LOW Oathkeeper 4 records MEDIUM Hydra 3 records LOW Keto 1 record LOW Kratos 1 record LOW Polis 1 record LOW

Records

4 records in Oathkeeper · all components

TI-2026-25890 CVE-2026-33494 · GHSA-p224-6x5r-fjpm

Ory Oathkeeper has a path traversal authorization bypass

Priority MEDIUM 49

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00528 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084758-8e0002140491 CWE-23
TI-2026-25892 CVE-2026-33496 · GHSA-4mq7-pvjg-xp2r

Ory Oathkeeper has an authentication bypass by cache key confusion

Priority LOW 35

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00384 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084801-198a2bc82a99 CWE-1289
TI-2026-25891 CVE-2026-33495 · GHSA-vhr5-ggp3-qq85

Ory Oathkeeper has an authentication bypass by usage of untrusted header

Priority LOW 34

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00243 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084810-e9acca14a04d CWE-862
Open these records in search →