Oory

Products

Exploited and recent CVEs

• CVE-2026-33506 High 8.8 DOM-Based XSS in Ory Polis Login Page 0.5%
• CVE-2026-33505 High 7.2 Ory Keto has a SQL injection via forged pagination tokens 0.2%
• CVE-2026-33504 High 7.2 Ory Hydra has a SQL injection via forged pagination tokens 0.4%
• CVE-2026-33503 High 7.2 Ory Kratos has a SQL injection via forged pagination tokens 0.3%
• CVE-2026-33496 High 8.1 Ory Oathkeeper has an authentication bypass by cache key confusion 0.4%
• CVE-2026-33495 Medium 6.5 Ory Oathkeeper has an authentication bypass by usage of untrusted header 0.2%
• CVE-2026-33494 Critical 10.0 Ory Oathkeeper has a path traversal authorization bypass 0.5%
• CVE-2024-45042 Medium 4.4 Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials 0.3%
• CVE-2021-32701 High 7.5 Possible bypass of token claim validation when OAuth2 Introspection caching is enabled 1.6%
• CVE-2020-15233 Medium 6.1 OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses 0.8%
• CVE-2020-15234 Medium 6.1 Redirect URL matching ignores character casing 0.8%
• CVE-2020-15222 High 8.1 Replay of private_key_jwt possible in ORY Fosite 0.9%
• CVE-2020-15223 High 8.0 Ignored storage errors on token revokation in ORY Fosite 1.6%
• CVE-2020-5300 Medium 5.8 Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra 1.0%