Vulnerability in Hashicorp Tooling
CVE-2025-1293
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
EPSS: 0.001 (21.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Hashicorp Tooling — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-1293?
- CVE-2025-1293 is a high-severity vulnerability in Hashicorp Tooling, classified under Weak Authentication. CVSS score: 8.2/10. Published 2025-02-20.
- How severe is CVE-2025-1293?
- High severity. CVSS v3 base score is 8.2 out of 10.