ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOry Hydra
APPOry0.10.10.00.10.10.10.100.10.20.10.30.10.40.10.50.10.60.10.70.10.80.10.90.11.00.11.10.11.10+ 75 więcej
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References
Related vulnerabilities
CVE-2026-33504HIGH7.2ten sam produkt
Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, ...
CVE-2020-5300MEDIUM5.8ten sam produkt
In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+...
CVE-2026-33494CRITICAL10.0PL ✓ten sam vendor
Ory Oathkeeper: pominięcie autoryzacji przez path traversal w URL
CVE-2026-33496HIGH8.1ten sam vendor
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques...
CVE-2026-33503HIGH7.2ten sam vendor
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2...