Ory

14 CVEs across 6 Ory products. Browse Ory vulnerabilities, severities, and proof-of-concept exploits.

Ory products with known CVEs

ProductCVEs
Fosite4
Oathkeeper4
Hydra3
Kratos2
Keto1
Polis1
Ory CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-33506High8.82026-03-26Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based…
CVE-2026-33505High7.22026-03-26Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable…
CVE-2026-33504High7.22026-03-26Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2J…
CVE-2026-33503High7.22026-03-26Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Krat…
CVE-2026-33496High8.12026-03-26ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior…
CVE-2026-33495Medium6.52026-03-26ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper…
CVE-2026-33494Critical10.02026-03-26ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior…
CVE-2024-45042Medium4.42024-09-26Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_…
CVE-2021-32701High7.52021-06-22ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a…
CVE-2020-15234Medium6.12020-10-02ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and t…
CVE-2020-15233Medium6.12020-10-02ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an…
CVE-2020-15223High8.02020-09-24In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the…
CVE-2020-15222High8.12020-09-24In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness o…
CVE-2020-5300Medium5.82020-04-06In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method…
CVE-2019-8400Medium6.12019-02-17ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.