Read the docs
TI-2019-06030 Aliases CVE-2019-8400GHSA-7v6r-w4r6-mhch

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.

Why it matters now

EPSS 0.01328 71st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed github.com/ory/hydra (Go): 1.4.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/ory/hydra (Go)before 1.4.81.4.8Patch availableGHSA-7v6r-w4r6-mhch
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/ory/hydra (Go) Vendor— Affected before 1.4.8 Fixed in 1.4.8 Patch available GHSA-7v6r-w4r6-mhch

CPE configurations NVD · 129

CPEVersionsRoleVendor
cpe:2.3:a:ory:hydra:0.1:beta1:*:*:*:*:*:*0.1 beta1Vulnerableory
cpe:2.3:a:ory:hydra:0.1:beta2:*:*:*:*:*:*0.1 beta2Vulnerableory
cpe:2.3:a:ory:hydra:0.1:beta3:*:*:*:*:*:*0.1 beta3Vulnerableory
cpe:2.3:a:ory:hydra:0.1:beta4:*:*:*:*:*:*0.1 beta4Vulnerableory
cpe:2.3:a:ory:hydra:0.2.0:*:*:*:*:*:*:*0.2.0Vulnerableory
cpe:2.3:a:ory:hydra:0.3.0:*:*:*:*:*:*:*0.3.0Vulnerableory
cpe:2.3:a:ory:hydra:0.3.1:*:*:*:*:*:*:*0.3.1Vulnerableory
cpe:2.3:a:ory:hydra:0.4.0:*:*:*:*:*:*:*0.4.0Vulnerableory
cpe:2.3:a:ory:hydra:0.4.1:*:*:*:*:*:*:*0.4.1Vulnerableory
cpe:2.3:a:ory:hydra:0.4.2:*:*:*:*:*:*:*0.4.2Vulnerableory
  • cpe:2.3:a:ory:hydra:0.1:beta1:*:*:*:*:*:* Versions 0.1 beta1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.1:beta2:*:*:*:*:*:* Versions 0.1 beta2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.1:beta3:*:*:*:*:*:* Versions 0.1 beta3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.1:beta4:*:*:*:*:*:* Versions 0.1 beta4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.3.0:*:*:*:*:*:*:* Versions 0.3.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.3.1:*:*:*:*:*:*:* Versions 0.3.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.0:*:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.2:*:*:*:*:*:*:* Versions 0.4.2 Vulnerable ·ory
Show 119 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ory:hydra:0.4.2:alpha:*:*:*:*:*:*0.4.2 alphaVulnerableory
cpe:2.3:a:ory:hydra:0.4.2:alpha1:*:*:*:*:*:*0.4.2 alpha1Vulnerableory
cpe:2.3:a:ory:hydra:0.4.2:alpha2:*:*:*:*:*:*0.4.2 alpha2Vulnerableory
cpe:2.3:a:ory:hydra:0.4.2:alpha3:*:*:*:*:*:*0.4.2 alpha3Vulnerableory
cpe:2.3:a:ory:hydra:0.4.2:alpha4:*:*:*:*:*:*0.4.2 alpha4Vulnerableory
cpe:2.3:a:ory:hydra:0.4.3:*:*:*:*:*:*:*0.4.3Vulnerableory
cpe:2.3:a:ory:hydra:0.5.0:*:*:*:*:*:*:*0.5.0Vulnerableory
cpe:2.3:a:ory:hydra:0.5.1:*:*:*:*:*:*:*0.5.1Vulnerableory
cpe:2.3:a:ory:hydra:0.5.2:*:*:*:*:*:*:*0.5.2Vulnerableory
cpe:2.3:a:ory:hydra:0.5.3:*:*:*:*:*:*:*0.5.3Vulnerableory
cpe:2.3:a:ory:hydra:0.5.4:*:*:*:*:*:*:*0.5.4Vulnerableory
cpe:2.3:a:ory:hydra:0.5.5:*:*:*:*:*:*:*0.5.5Vulnerableory
cpe:2.3:a:ory:hydra:0.5.6:*:*:*:*:*:*:*0.5.6Vulnerableory
cpe:2.3:a:ory:hydra:0.5.7:*:*:*:*:*:*:*0.5.7Vulnerableory
cpe:2.3:a:ory:hydra:0.5.8:*:*:*:*:*:*:*0.5.8Vulnerableory
cpe:2.3:a:ory:hydra:0.6.0:*:*:*:*:*:*:*0.6.0Vulnerableory
cpe:2.3:a:ory:hydra:0.6.1:*:*:*:*:*:*:*0.6.1Vulnerableory
cpe:2.3:a:ory:hydra:0.6.2:*:*:*:*:*:*:*0.6.2Vulnerableory
cpe:2.3:a:ory:hydra:0.6.3:*:*:*:*:*:*:*0.6.3Vulnerableory
cpe:2.3:a:ory:hydra:0.6.4:*:*:*:*:*:*:*0.6.4Vulnerableory
cpe:2.3:a:ory:hydra:0.6.5:*:*:*:*:*:*:*0.6.5Vulnerableory
cpe:2.3:a:ory:hydra:0.6.6:*:*:*:*:*:*:*0.6.6Vulnerableory
cpe:2.3:a:ory:hydra:0.6.7:*:*:*:*:*:*:*0.6.7Vulnerableory
cpe:2.3:a:ory:hydra:0.6.8:*:*:*:*:*:*:*0.6.8Vulnerableory
cpe:2.3:a:ory:hydra:0.6.9:*:*:*:*:*:*:*0.6.9Vulnerableory
cpe:2.3:a:ory:hydra:0.6.10:*:*:*:*:*:*:*0.6.10Vulnerableory
cpe:2.3:a:ory:hydra:0.7.0:*:*:*:*:*:*:*0.7.0Vulnerableory
cpe:2.3:a:ory:hydra:0.7.1:*:*:*:*:*:*:*0.7.1Vulnerableory
cpe:2.3:a:ory:hydra:0.7.2:*:*:*:*:*:*:*0.7.2Vulnerableory
cpe:2.3:a:ory:hydra:0.7.3:*:*:*:*:*:*:*0.7.3Vulnerableory
cpe:2.3:a:ory:hydra:0.7.4:*:*:*:*:*:*:*0.7.4Vulnerableory
cpe:2.3:a:ory:hydra:0.7.5:*:*:*:*:*:*:*0.7.5Vulnerableory
cpe:2.3:a:ory:hydra:0.7.6:*:*:*:*:*:*:*0.7.6Vulnerableory
cpe:2.3:a:ory:hydra:0.7.7:*:*:*:*:*:*:*0.7.7Vulnerableory
cpe:2.3:a:ory:hydra:0.7.8:*:*:*:*:*:*:*0.7.8Vulnerableory
cpe:2.3:a:ory:hydra:0.7.9:*:*:*:*:*:*:*0.7.9Vulnerableory
cpe:2.3:a:ory:hydra:0.7.10:*:*:*:*:*:*:*0.7.10Vulnerableory
cpe:2.3:a:ory:hydra:0.7.11:*:*:*:*:*:*:*0.7.11Vulnerableory
cpe:2.3:a:ory:hydra:0.7.12:*:*:*:*:*:*:*0.7.12Vulnerableory
cpe:2.3:a:ory:hydra:0.7.13:*:*:*:*:*:*:*0.7.13Vulnerableory
cpe:2.3:a:ory:hydra:0.8.0:*:*:*:*:*:*:*0.8.0Vulnerableory
cpe:2.3:a:ory:hydra:0.8.1:*:*:*:*:*:*:*0.8.1Vulnerableory
cpe:2.3:a:ory:hydra:0.8.2:*:*:*:*:*:*:*0.8.2Vulnerableory
cpe:2.3:a:ory:hydra:0.8.3:*:*:*:*:*:*:*0.8.3Vulnerableory
cpe:2.3:a:ory:hydra:0.8.4:*:*:*:*:*:*:*0.8.4Vulnerableory
cpe:2.3:a:ory:hydra:0.8.5:*:*:*:*:*:*:*0.8.5Vulnerableory
cpe:2.3:a:ory:hydra:0.8.6:*:*:*:*:*:*:*0.8.6Vulnerableory
cpe:2.3:a:ory:hydra:0.8.7:*:*:*:*:*:*:*0.8.7Vulnerableory
cpe:2.3:a:ory:hydra:0.9.0:*:*:*:*:*:*:*0.9.0Vulnerableory
cpe:2.3:a:ory:hydra:0.9.1:*:*:*:*:*:*:*0.9.1Vulnerableory
cpe:2.3:a:ory:hydra:0.9.2:*:*:*:*:*:*:*0.9.2Vulnerableory
cpe:2.3:a:ory:hydra:0.9.3:*:*:*:*:*:*:*0.9.3Vulnerableory
cpe:2.3:a:ory:hydra:0.9.4:*:*:*:*:*:*:*0.9.4Vulnerableory
cpe:2.3:a:ory:hydra:0.9.5:*:*:*:*:*:*:*0.9.5Vulnerableory
cpe:2.3:a:ory:hydra:0.9.6:*:*:*:*:*:*:*0.9.6Vulnerableory
cpe:2.3:a:ory:hydra:0.9.7:*:*:*:*:*:*:*0.9.7Vulnerableory
cpe:2.3:a:ory:hydra:0.9.8:*:*:*:*:*:*:*0.9.8Vulnerableory
cpe:2.3:a:ory:hydra:0.9.9:*:*:*:*:*:*:*0.9.9Vulnerableory
cpe:2.3:a:ory:hydra:0.9.10:*:*:*:*:*:*:*0.9.10Vulnerableory
cpe:2.3:a:ory:hydra:0.9.11:*:*:*:*:*:*:*0.9.11Vulnerableory
cpe:2.3:a:ory:hydra:0.9.12:*:*:*:*:*:*:*0.9.12Vulnerableory
cpe:2.3:a:ory:hydra:0.9.13:*:*:*:*:*:*:*0.9.13Vulnerableory
cpe:2.3:a:ory:hydra:0.9.14:*:*:*:*:*:*:*0.9.14Vulnerableory
cpe:2.3:a:ory:hydra:0.9.15:*:*:*:*:*:*:*0.9.15Vulnerableory
cpe:2.3:a:ory:hydra:0.9.16:*:*:*:*:*:*:*0.9.16Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:*:*:*:*:*:*:*0.10.0Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha1:*:*:*:*:*:*0.10.0 alpha1Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha10:*:*:*:*:*:*0.10.0 alpha10Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha11:*:*:*:*:*:*0.10.0 alpha11Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha12:*:*:*:*:*:*0.10.0 alpha12Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha13:*:*:*:*:*:*0.10.0 alpha13Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha14:*:*:*:*:*:*0.10.0 alpha14Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha15:*:*:*:*:*:*0.10.0 alpha15Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha16:*:*:*:*:*:*0.10.0 alpha16Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha17:*:*:*:*:*:*0.10.0 alpha17Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha18:*:*:*:*:*:*0.10.0 alpha18Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha19:*:*:*:*:*:*0.10.0 alpha19Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha2:*:*:*:*:*:*0.10.0 alpha2Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha20:*:*:*:*:*:*0.10.0 alpha20Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha21:*:*:*:*:*:*0.10.0 alpha21Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha3:*:*:*:*:*:*0.10.0 alpha3Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha4:*:*:*:*:*:*0.10.0 alpha4Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha5:*:*:*:*:*:*0.10.0 alpha5Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha6:*:*:*:*:*:*0.10.0 alpha6Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha7:*:*:*:*:*:*0.10.0 alpha7Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha8:*:*:*:*:*:*0.10.0 alpha8Vulnerableory
cpe:2.3:a:ory:hydra:0.10.0:alpha9:*:*:*:*:*:*0.10.0 alpha9Vulnerableory
cpe:2.3:a:ory:hydra:0.10.1:*:*:*:*:*:*:*0.10.1Vulnerableory
cpe:2.3:a:ory:hydra:0.10.2:*:*:*:*:*:*:*0.10.2Vulnerableory
cpe:2.3:a:ory:hydra:0.10.3:*:*:*:*:*:*:*0.10.3Vulnerableory
cpe:2.3:a:ory:hydra:0.10.4:*:*:*:*:*:*:*0.10.4Vulnerableory
cpe:2.3:a:ory:hydra:0.10.5:*:*:*:*:*:*:*0.10.5Vulnerableory
cpe:2.3:a:ory:hydra:0.10.6:*:*:*:*:*:*:*0.10.6Vulnerableory
cpe:2.3:a:ory:hydra:0.10.7:*:*:*:*:*:*:*0.10.7Vulnerableory
cpe:2.3:a:ory:hydra:0.10.8:*:*:*:*:*:*:*0.10.8Vulnerableory
cpe:2.3:a:ory:hydra:0.10.9:*:*:*:*:*:*:*0.10.9Vulnerableory
cpe:2.3:a:ory:hydra:0.10.10:*:*:*:*:*:*:*0.10.10Vulnerableory
cpe:2.3:a:ory:hydra:0.11.0:*:*:*:*:*:*:*0.11.0Vulnerableory
cpe:2.3:a:ory:hydra:0.11.1:*:*:*:*:*:*:*0.11.1Vulnerableory
cpe:2.3:a:ory:hydra:0.11.2:*:*:*:*:*:*:*0.11.2Vulnerableory
cpe:2.3:a:ory:hydra:0.11.3:*:*:*:*:*:*:*0.11.3Vulnerableory
cpe:2.3:a:ory:hydra:0.11.4:*:*:*:*:*:*:*0.11.4Vulnerableory
cpe:2.3:a:ory:hydra:0.11.6:*:*:*:*:*:*:*0.11.6Vulnerableory
cpe:2.3:a:ory:hydra:0.11.7:*:*:*:*:*:*:*0.11.7Vulnerableory
cpe:2.3:a:ory:hydra:0.11.9:*:*:*:*:*:*:*0.11.9Vulnerableory
cpe:2.3:a:ory:hydra:0.11.10:*:*:*:*:*:*:*0.11.10Vulnerableory
cpe:2.3:a:ory:hydra:0.11.12:*:*:*:*:*:*:*0.11.12Vulnerableory
cpe:2.3:a:ory:hydra:0.11.14:*:*:*:*:*:*:*0.11.14Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta1:*:*:*:*:*:*1.0.0 beta1Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta2:*:*:*:*:*:*1.0.0 beta2Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta3:*:*:*:*:*:*1.0.0 beta3Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta4:*:*:*:*:*:*1.0.0 beta4Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta5:*:*:*:*:*:*1.0.0 beta5Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta6:*:*:*:*:*:*1.0.0 beta6Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta7:*:*:*:*:*:*1.0.0 beta7Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta8:*:*:*:*:*:*1.0.0 beta8Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:beta9:*:*:*:*:*:*1.0.0 beta9Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:rc1:*:*:*:*:*:*1.0.0 rc1Vulnerableory
cpe:2.3:a:ory:hydra:1.0.0:rc2:*:*:*:*:*:*1.0.0 rc2Vulnerableory
  • cpe:2.3:a:ory:hydra:0.4.2:alpha:*:*:*:*:*:* Versions 0.4.2 alpha Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.2:alpha1:*:*:*:*:*:* Versions 0.4.2 alpha1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.2:alpha2:*:*:*:*:*:* Versions 0.4.2 alpha2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.2:alpha3:*:*:*:*:*:* Versions 0.4.2 alpha3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.2:alpha4:*:*:*:*:*:* Versions 0.4.2 alpha4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.4.3:*:*:*:*:*:*:* Versions 0.4.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.1:*:*:*:*:*:*:* Versions 0.5.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.2:*:*:*:*:*:*:* Versions 0.5.2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.3:*:*:*:*:*:*:* Versions 0.5.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.4:*:*:*:*:*:*:* Versions 0.5.4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.5:*:*:*:*:*:*:* Versions 0.5.5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.6:*:*:*:*:*:*:* Versions 0.5.6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.7:*:*:*:*:*:*:* Versions 0.5.7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.5.8:*:*:*:*:*:*:* Versions 0.5.8 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.1:*:*:*:*:*:*:* Versions 0.6.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.2:*:*:*:*:*:*:* Versions 0.6.2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.3:*:*:*:*:*:*:* Versions 0.6.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.4:*:*:*:*:*:*:* Versions 0.6.4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.5:*:*:*:*:*:*:* Versions 0.6.5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.6:*:*:*:*:*:*:* Versions 0.6.6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.7:*:*:*:*:*:*:* Versions 0.6.7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.8:*:*:*:*:*:*:* Versions 0.6.8 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.9:*:*:*:*:*:*:* Versions 0.6.9 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.6.10:*:*:*:*:*:*:* Versions 0.6.10 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.2:*:*:*:*:*:*:* Versions 0.7.2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.3:*:*:*:*:*:*:* Versions 0.7.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.4:*:*:*:*:*:*:* Versions 0.7.4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.5:*:*:*:*:*:*:* Versions 0.7.5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.6:*:*:*:*:*:*:* Versions 0.7.6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.7:*:*:*:*:*:*:* Versions 0.7.7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.8:*:*:*:*:*:*:* Versions 0.7.8 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.9:*:*:*:*:*:*:* Versions 0.7.9 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.10:*:*:*:*:*:*:* Versions 0.7.10 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.11:*:*:*:*:*:*:* Versions 0.7.11 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.12:*:*:*:*:*:*:* Versions 0.7.12 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.7.13:*:*:*:*:*:*:* Versions 0.7.13 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.3:*:*:*:*:*:*:* Versions 0.8.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.6:*:*:*:*:*:*:* Versions 0.8.6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.8.7:*:*:*:*:*:*:* Versions 0.8.7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.5:*:*:*:*:*:*:* Versions 0.9.5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.7:*:*:*:*:*:*:* Versions 0.9.7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.10:*:*:*:*:*:*:* Versions 0.9.10 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.11:*:*:*:*:*:*:* Versions 0.9.11 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.12:*:*:*:*:*:*:* Versions 0.9.12 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.13:*:*:*:*:*:*:* Versions 0.9.13 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.14:*:*:*:*:*:*:* Versions 0.9.14 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.15:*:*:*:*:*:*:* Versions 0.9.15 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.9.16:*:*:*:*:*:*:* Versions 0.9.16 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha1:*:*:*:*:*:* Versions 0.10.0 alpha1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha10:*:*:*:*:*:* Versions 0.10.0 alpha10 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha11:*:*:*:*:*:* Versions 0.10.0 alpha11 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha12:*:*:*:*:*:* Versions 0.10.0 alpha12 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha13:*:*:*:*:*:* Versions 0.10.0 alpha13 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha14:*:*:*:*:*:* Versions 0.10.0 alpha14 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha15:*:*:*:*:*:* Versions 0.10.0 alpha15 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha16:*:*:*:*:*:* Versions 0.10.0 alpha16 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha17:*:*:*:*:*:* Versions 0.10.0 alpha17 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha18:*:*:*:*:*:* Versions 0.10.0 alpha18 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha19:*:*:*:*:*:* Versions 0.10.0 alpha19 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha2:*:*:*:*:*:* Versions 0.10.0 alpha2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha20:*:*:*:*:*:* Versions 0.10.0 alpha20 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha21:*:*:*:*:*:* Versions 0.10.0 alpha21 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha3:*:*:*:*:*:* Versions 0.10.0 alpha3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha4:*:*:*:*:*:* Versions 0.10.0 alpha4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha5:*:*:*:*:*:* Versions 0.10.0 alpha5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha6:*:*:*:*:*:* Versions 0.10.0 alpha6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha7:*:*:*:*:*:* Versions 0.10.0 alpha7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha8:*:*:*:*:*:* Versions 0.10.0 alpha8 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.0:alpha9:*:*:*:*:*:* Versions 0.10.0 alpha9 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.1:*:*:*:*:*:*:* Versions 0.10.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.2:*:*:*:*:*:*:* Versions 0.10.2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.3:*:*:*:*:*:*:* Versions 0.10.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.4:*:*:*:*:*:*:* Versions 0.10.4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.5:*:*:*:*:*:*:* Versions 0.10.5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.6:*:*:*:*:*:*:* Versions 0.10.6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.7:*:*:*:*:*:*:* Versions 0.10.7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.8:*:*:*:*:*:*:* Versions 0.10.8 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.9:*:*:*:*:*:*:* Versions 0.10.9 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.10.10:*:*:*:*:*:*:* Versions 0.10.10 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.0:*:*:*:*:*:*:* Versions 0.11.0 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.1:*:*:*:*:*:*:* Versions 0.11.1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.2:*:*:*:*:*:*:* Versions 0.11.2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.3:*:*:*:*:*:*:* Versions 0.11.3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.4:*:*:*:*:*:*:* Versions 0.11.4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.6:*:*:*:*:*:*:* Versions 0.11.6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.7:*:*:*:*:*:*:* Versions 0.11.7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.9:*:*:*:*:*:*:* Versions 0.11.9 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.10:*:*:*:*:*:*:* Versions 0.11.10 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.12:*:*:*:*:*:*:* Versions 0.11.12 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:0.11.14:*:*:*:*:*:*:* Versions 0.11.14 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta1:*:*:*:*:*:* Versions 1.0.0 beta1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta2:*:*:*:*:*:* Versions 1.0.0 beta2 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta3:*:*:*:*:*:* Versions 1.0.0 beta3 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta4:*:*:*:*:*:* Versions 1.0.0 beta4 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta5:*:*:*:*:*:* Versions 1.0.0 beta5 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta6:*:*:*:*:*:* Versions 1.0.0 beta6 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta7:*:*:*:*:*:* Versions 1.0.0 beta7 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta8:*:*:*:*:*:* Versions 1.0.0 beta8 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:beta9:*:*:*:*:*:* Versions 1.0.0 beta9 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·ory
  • cpe:2.3:a:ory:hydra:1.0.0:rc2:*:*:*:*:*:* Versions 1.0.0 rc2 Vulnerable ·ory

Remediation

  • Fix · GHSA-7v6r-w4r6-mhch github.com/ory/hydra (Go) Fixed in 1.4.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-8400
  2. 2026-10-03 Alias added: GHSA-7v6r-w4r6-mhch

References

Exploit 2

Patch 1

Advisory 3

Other 1

  • TI-2026-25900 Ory Hydra has a SQL injection via forged pagination tokens CVSS 3.1HIGH 7.2
  • TI-2020-04356 Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences