CVE-2026-33504

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33504", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-20T16:59:08.888Z", "datePublished": "2026-03-26T17:38:10.809Z", "dateUpdated": "2026-03-26T18:46:01.194Z"}, "containers": {"cna": {"title": "Ory Hydra has a SQL injection via forged pagination tokens", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ory/hydra/security/advisories/GHSA-r9w3-57w2-gch2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ory/hydra/security/advisories/GHSA-r9w3-57w2-gch2"}], "affected": [{"vendor": "ory", "product": "hydra", "versions": [{"version": "< 26.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T17:38:10.809Z"}, "descriptions": [{"lang": "en", "value": "Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. If this value is not set, Hydra falls back to using `secrets.system`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. This issue can be exploited when one or more admin APIs listed above are directly or indirectly accessible to the attacker; the attacker can pass a raw pagination token to the affected API; and the configuration value `secrets.pagination` is set and known to the attacker, or `secrets.pagination` is not set and `secrets.system` is known to the attacker. An attacker can execute arbitrary SQL queries through forged pagination tokens. As a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret. Next, upgrade Hydra to the fixed version, 26.2.0 as soon as possible."}], "source": {"advisory": "GHSA-r9w3-57w2-gch2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T18:45:50.987973Z", "id": "CVE-2026-33504", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:46:01.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T18:45:50.987973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:45:55.864Z"}}], "cna": {"title": "Ory Hydra has a SQL injection via forged pagination tokens", "source": {"advisory": "GHSA-r9w3-57w2-gch2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ory", "product": "hydra", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "references": [{"url": "https://github.com/ory/hydra/security/advisories/GHSA-r9w3-57w2-gch2", "name": "https://github.com/ory/hydra/security/advisories/GHSA-r9w3-57w2-gch2", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. If this value is not set, Hydra falls back to using `secrets.system`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. This issue can be exploited when one or more admin APIs listed above are directly or indirectly accessible to the attacker; the attacker can pass a raw pagination token to the affected API; and the configuration value `secrets.pagination` is set and known to the attacker, or `secrets.pagination` is not set and `secrets.system` is known to the attacker. An attacker can execute arbitrary SQL queries through forged pagination tokens. As a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret. Next, upgrade Hydra to the fixed version, 26.2.0 as soon as possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T17:38:10.809Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33504", "state": "PUBLISHED", "dateUpdated": "2026-03-26T18:46:01.194Z", "dateReserved": "2026-03-20T16:59:08.888Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T17:38:10.809Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hydra", "vendor": "ory", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ory:hydra:*:*:*:*:*:*:*:*", "matchCriteriaId": "40E1DCE0-DDF8-4635-AA66-9150D5A65075", "versionEndExcluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. If this value is not set, Hydra falls back to using `secrets.system`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. This issue can be exploited when one or more admin APIs listed above are directly or indirectly accessible to the attacker; the attacker can pass a raw pagination token to the affected API; and the configuration value `secrets.pagination` is set and known to the attacker, or `secrets.pagination` is not set and `secrets.system` is known to the attacker. An attacker can execute arbitrary SQL queries through forged pagination tokens. As a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret. Next, upgrade Hydra to the fixed version, 26.2.0 as soon as possible."}, {"lang": "es", "value": "Ory Hydra es un servidor OAuth 2.0 y un proveedor de OpenID Connect. Antes de la versi\u00f3n 26.2.0, las API de administraci\u00f3n listOAuth2Clients, listOAuth2ConsentSessions y listTrustedOAuth2JwtGrantIssuers en Ory Hydra son vulnerables a inyecci\u00f3n SQL debido a fallos en su implementaci\u00f3n de paginaci\u00f3n. Los tokens de paginaci\u00f3n se cifran usando el secreto configurado en `secrets.pagination`. Si este valor no est\u00e1 configurado, Hydra recurre a usar `secrets.system`. Un atacante que conoce este secreto puede crear sus propios tokens, incluyendo tokens maliciosos que conducen a inyecci\u00f3n SQL. Este problema puede ser explotado cuando una o m\u00e1s API de administraci\u00f3n listadas anteriormente son directa o indirectamente accesibles para el atacante; el atacante puede pasar un token de paginaci\u00f3n sin procesar a la API afectada; y el valor de configuraci\u00f3n `secrets.pagination` est\u00e1 configurado y es conocido por el atacante, o `secrets.pagination` no est\u00e1 configurado y `secrets.system` es conocido por el atacante. Un atacante puede ejecutar consultas SQL arbitrarias a trav\u00e9s de tokens de paginaci\u00f3n falsificados. Como primera l\u00ednea de defensa, configure inmediatamente un valor personalizado para `secrets.pagination` generando un secreto aleatorio criptogr\u00e1ficamente seguro. A continuaci\u00f3n, actualice Hydra a la versi\u00f3n corregida, 26.2.0 lo antes posible."}], "id": "CVE-2026-33504", "lastModified": "2026-06-17T10:37:36.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33504", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T18:45:50.987973Z", "version": "2.0.3"}}]}, "published": "2026-03-26T18:16:31.060", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/ory/hydra/security/advisories/GHSA-r9w3-57w2-gch2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hydra", "source": "cna", "vendor": "ory"}, "product": "hydra", "vendor": "ory"}], "analysis": {"en": {"generated_at": "2026-04-08T00:25:18.694020+00:00", "value": {"mitigation_remediation": ["Upgrade Ory Hydra to version 26.2.0 or later", "Configure a new cryptographically secure value for secrets.pagination (or secrets.system if pagination is unset)", "Restrict access to the admin APIs so that only trusted hosts or privileged users can reach them", "Monitor API logs for unusual pagination token usage or repeated injection attempts"], "summary": {"action": "Patch", "impact": "arbitrary SQL injection via forged pagination tokens"}, "threat_synthesis": {"affected_systems": "The issue affects Ory Hydra versions older than 26.2.0, specifically the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers admin APIs. Pagination tokens are encrypted with the secret configured in secrets.pagination; if that secret is not set, secrets.system is used instead. An attacker who can reach these APIs and knows the relevant secret can craft a token that triggers the injection.", "description_and_impact": "A flaw in Ory Hydra\u2019s administrative pagination handling allows an attacker to supply a crafted token that is directly inserted into an SQL statement. This results in injection of arbitrary SQL code, providing the attacker with the ability to read, modify or delete database contents. The vulnerability does not grant arbitrary system code execution, but it does enable full compromise of the Hydra data store.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a serious level of risk, while the EPSS score is reported as less than 1% and the vulnerability is not present in the CISA KEV catalog. Exploitation requires direct access to one of the affected admin endpoints and knowledge of the pagination or system secret. If the secret is misconfigured or exposed, the attack path is straightforward; otherwise, the risk is lowered by secrecy of the key."}}}}, "created": "2026-03-27T08:33:24.808516+00:00", "updated": "2026-04-08T20:01:11.735537+00:00", "vendors": ["ory", "ory$PRODUCT$hydra"]}