Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

hydra — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in hydra, with AI-generated Chinese analysis, references, and POCs.

This is the vulnerability aggregation page for Hydra, developed by Mizar Systems, focusing on general security weaknesses and configuration flaws. The page collects historical and current vulnerability data associated with the Hydra network login protection software, covering entries from its initial releases through recent updates. It aggregates findings related to authentication bypasses, buffer overflows, and denial-of-service conditions that may affect its deployment in various network environments. Readers can use this resource to track vendor advisories and patch releases issued by Mizar Systems as they address reported security issues. You can also gain a deeper understanding of specific weakness classes, such as input validation errors or credential management failures, that frequently impact this type of authentication service. Additionally, the page allows you to look up a product's vulnerability history, providing a chronological view of how its security posture has evolved over time. This comprehensive overview helps security professionals and system administrators assess risk exposure and prioritize remediation efforts. By examining the complete timeline of reported flaws, users can identify patterns in vulnerability discovery and evaluate the effectiveness of past security fixes. The data serves as a reference for auditing Hydra installations and ensuring they are updated to the most secure versions available. This resource supports informed decision-making regarding the continued use of Hydra in production networks. It is designed to provide clear, factual information without speculation, enabling accurate risk assessment and compliance reporting.

Vendor: ory

CVE ID Title CVSS Severity Published
CVE-2026-106442 Hydra instantiate target blacklist bypasses permit code execution CWE-184 7.8 High 2026-10-06
CVE-2026-106441 Hydra logging configuration permits unsafe callable resolution CWE-94 7.8 High 2026-10-06
CVE-2026-106440 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method CWE-470 7.8 High 2026-10-06
CVE-2026-106439 Hydra: Mutable instantiate policy sets allow target blocklist bypass CWE-470 8.5 High 2026-10-06
CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution CWE-94 7.8 High 2026-08-21
CVE-2026-33504 Ory Hydra has a SQL injection via forged pagination tokens CWE-89 7.2 High 2026-03-26
CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins CWE-306 7.5AI High AI 2025-08-12
CVE-2025-54800 Hydra persistent XSS in build metrics CWE-79 6.1AI Medium AI 2025-08-12
CVE-2025-48886 hydra-node dangerously assumes L1 event finality and does not consider failed transactions CWE-755 4.8 Medium 2025-06-19
CVE-2025-32435 Hydra no restricted eval after nix-eval-jobs migration CWE-95 2.6 Low 2025-04-15
CVE-2024-45049 Nix Hydra Missing authentication when triggering evaluations CWE-306 7.5 High 2024-08-27
CVE-2024-32657 Hydra has persistent XSS vulnerability serving HTML build outputs CWE-79 4.6 Medium 2024-04-22
CVE-2023-42449 Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits CWE-20 8.1 High 2023-10-04
CVE-2023-42448 Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline CWE-20 8.1 High 2023-10-04
CVE-2023-38701 Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone CWE-20 9.1 Critical 2023-10-04
CVE-2023-42806 Snapshot signature not including HeadID will allow replay attacks CWE-347 6.5 Medium 2023-09-21
CVE-2020-5300 Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra CWE-294 5.8 Medium 2020-04-06

All 17 known CVE vulnerabilities affecting hydra with full Chinese analysis, references, and POCs where available.