Read the docs
TI-2020-04356 Aliases CVE-2020-5300GHSA-3p3g-vpw6-4w66

Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra

Priority LOW 28CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-294.

Summary

In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17

Why it matters now

EPSS 0.01028 63rd percentileScored 2026-11-07
Fix Fixed hydra (ory): 1.4.0+oryOS.17github.com/ory/hydra (Go): 1.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
oryhydrabefore 1.4.0+oryOS.171.4.0+oryOS.17Patch availableCNA
—github.com/ory/hydra (Go)before 1.4.01.4.0Patch availableGHSA-3p3g-vpw6-4w66
  • hydra Vendorory Affected before 1.4.0+oryOS.17 Fixed in 1.4.0+oryOS.17 Patch available CNA
  • github.com/ory/hydra (Go) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-3p3g-vpw6-4w66

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ory:hydra:*:*:*:*:*:*:*:*before 1.4.0Vulnerableory
  • cpe:2.3:a:ory:hydra:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·ory

Remediation

  • Fix · CNA hydra (ory) Fixed in 1.4.0+oryOS.17
  • Fix · GHSA-3p3g-vpw6-4w66 github.com/ory/hydra (Go) Fixed in 1.4.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5300
  2. 2026-10-03 Alias added: GHSA-3p3g-vpw6-4w66

References

Patch 1

Advisory 3

Other 2

  • TI-2026-25900 Ory Hydra has a SQL injection via forged pagination tokens CVSS 3.1HIGH 7.2
  • TI-2019-06030 ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences