Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

ory — Vulnerabilities & Security Advisories 14

Browse all 14 CVE security advisories affecting ory. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by ory:fositeoathkeeperhydrakratosketopolis
CVE IDTitleCVSSSeverityPublished
CVE-2026-33506 DOM-Based XSS in Ory Polis Login Page — polisCWE-87 8.8 High2026-03-26
CVE-2026-33505 Ory Keto has a SQL injection via forged pagination tokens — ketoCWE-89 7.2 High2026-03-26
CVE-2026-33504 Ory Hydra has a SQL injection via forged pagination tokens — hydraCWE-89 7.2 High2026-03-26
CVE-2026-33503 Ory Kratos has a SQL injection via forged pagination tokens — kratosCWE-89 7.2 High2026-03-26
CVE-2026-33496 Ory Oathkeeper has an authentication bypass by cache key confusion — oathkeeperCWE-1289 8.1 High2026-03-26
CVE-2026-33495 Ory Oathkeeper has an authentication bypass by usage of untrusted header — oathkeeperCWE-862 6.5 Medium2026-03-26
CVE-2026-33494 Ory Oathkeeper has a path traversal authorization bypass — oathkeeperCWE-23 10.0 Critical2026-03-26
CVE-2024-45042 Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials — kratosCWE-287 4.4 Medium2024-09-26
CVE-2021-32701 Possible bypass of token claim validation when OAuth2 Introspection caching is enabled — oathkeeperCWE-863 7.5 High2021-06-22
CVE-2020-15233 OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses — fositeCWE-20 6.1 Medium2020-10-02
CVE-2020-15234 Redirect URL matching ignores character casing — fositeCWE-20 6.1 Medium2020-10-02
CVE-2020-15222 Replay of private_key_jwt possible in ORY Fosite — fositeCWE-287 8.1 High2020-09-24
CVE-2020-15223 Ignored storage errors on token revokation in ORY Fosite — fositeCWE-755 8.0 High2020-09-24
CVE-2020-5300 Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra — hydraCWE-294 5.8 Medium2020-04-06

This page lists every published CVE security advisory associated with ory. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.