ory vulnerabilities

CVEs per yearBy the year they were published

1. 20205
2. 20211
3. 20241
4. 20267

Newest CVEs

• CVE-2026-33506

  DOM-Based XSS in Ory Polis Login Page

  ory · polis

  High8.8
• CVE-2026-33505

  Ory Keto has a SQL injection via forged pagination tokens

  ory · keto

  High7.2
• CVE-2026-33504

  Ory Hydra has a SQL injection via forged pagination tokens

  ory · hydra

  High7.2
• CVE-2026-33503

  Ory Kratos has a SQL injection via forged pagination tokens

  ory · kratos

  High7.2
• CVE-2026-33496

  Ory Oathkeeper has an authentication bypass by cache key confusion

  ory · oathkeeper

  High8.1
• CVE-2026-33495

  Ory Oathkeeper has an authentication bypass by usage of untrusted header

  ory · oathkeeper

  Medium6.5
• CVE-2026-33494

  Ory Oathkeeper has a path traversal authorization bypass

  ory · oathkeeper

  Critical10.0
• CVE-2024-45042

  Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials

  ory · kratos

  Medium4.4
• CVE-2021-32701

  Possible bypass of token claim validation when OAuth2 Introspection caching is enabled

  ory · oathkeeper

  High7.5
• CVE-2020-15233

  OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses

  ory · fosite

  Medium6.1