Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: ory Component: Oathkeeper Clear all filters
TI-2026-25892 CVE-2026-33496 · GHSA-4mq7-pvjg-xp2r

Ory Oathkeeper has an authentication bypass by cache key confusion

Priority LOW 35

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00384 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084801-198a2bc82a99 CWE-1289
TI-2026-25891 CVE-2026-33495 · GHSA-vhr5-ggp3-qq85

Ory Oathkeeper has an authentication bypass by usage of untrusted header

Priority LOW 34

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00243 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084810-e9acca14a04d CWE-862
TI-2026-25890 CVE-2026-33494 · GHSA-p224-6x5r-fjpm

Ory Oathkeeper has a path traversal authorization bypass

Priority MEDIUM 49

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00528 Published 2026-03-26 Fixed in 26.2.0, 0.40.10-0.20260320084758-8e0002140491 CWE-23