CVE-2026-33504

{"id": "CVE-2026-33504", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2026-03-26T18:16:31.060", "references": [{"url": "https://github.com/ory/hydra/security/advisories/GHSA-r9w3-57w2-gch2", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. If this value is not set, Hydra falls back to using `secrets.system`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. This issue can be exploited when one or more admin APIs listed above are directly or indirectly accessible to the attacker; the attacker can pass a raw pagination token to the affected API; and the configuration value `secrets.pagination` is set and known to the attacker, or `secrets.pagination` is not set and `secrets.system` is known to the attacker. An attacker can execute arbitrary SQL queries through forged pagination tokens. As a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret. Next, upgrade Hydra to the fixed version, 26.2.0 as soon as possible."}, {"lang": "es", "value": "Ory Hydra es un servidor OAuth 2.0 y un proveedor de OpenID Connect. Antes de la versi\u00f3n 26.2.0, las API de administraci\u00f3n listOAuth2Clients, listOAuth2ConsentSessions y listTrustedOAuth2JwtGrantIssuers en Ory Hydra son vulnerables a inyecci\u00f3n SQL debido a fallos en su implementaci\u00f3n de paginaci\u00f3n. Los tokens de paginaci\u00f3n se cifran usando el secreto configurado en `secrets.pagination`. Si este valor no est\u00e1 configurado, Hydra recurre a usar `secrets.system`. Un atacante que conoce este secreto puede crear sus propios tokens, incluyendo tokens maliciosos que conducen a inyecci\u00f3n SQL. Este problema puede ser explotado cuando una o m\u00e1s API de administraci\u00f3n listadas anteriormente son directa o indirectamente accesibles para el atacante; el atacante puede pasar un token de paginaci\u00f3n sin procesar a la API afectada; y el valor de configuraci\u00f3n `secrets.pagination` est\u00e1 configurado y es conocido por el atacante, o `secrets.pagination` no est\u00e1 configurado y `secrets.system` es conocido por el atacante. Un atacante puede ejecutar consultas SQL arbitrarias a trav\u00e9s de tokens de paginaci\u00f3n falsificados. Como primera l\u00ednea de defensa, configure inmediatamente un valor personalizado para `secrets.pagination` generando un secreto aleatorio criptogr\u00e1ficamente seguro. A continuaci\u00f3n, actualice Hydra a la versi\u00f3n corregida, 26.2.0 lo antes posible."}], "lastModified": "2026-04-07T21:15:36.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ory:hydra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40E1DCE0-DDF8-4635-AA66-9150D5A65075", "versionEndExcluding": "26.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}