CVE-2019-8400: ORY Hydra Reflected XSS via error_hint Parameter
Summary
CVE-2019-8400: Hydra has Reflected XSS via error_hint parameter. Affects github.com/ory/hydra versions < 1.4.8. Fixed in 1.4.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ORY Hydra is an open-source OAuth2 and OpenID Connect server designed to manage user authentication and authorization. It provides a secure way to handle user identities and access tokens, making it a crucial component for applications that require user login and data protection. However, prior to version 1.0.0-rc.3+oryOS.9, Hydra was susceptible to a reflected cross-site scripting (XSS) vulnerability, which could be exploited through the error_hint parameter in specific error responses.
Vulnerability Detail
The vulnerability, identified as CVE-2019-8400, arises from the improper handling of the error_hint parameter in the oauth2/fallbacks/error endpoint. Attackers can exploit this flaw by crafting a malicious URL that includes a payload in the error_hint parameter. When a user clicks on this URL, the payload is reflected back in the response, leading to potential execution of arbitrary JavaScript code in the user's browser. This could result in session hijacking, data theft, or other malicious actions, posing a significant risk to users and their data.
How To Fix
Latest published version: v1.11.10 as of 23 Oct 2026
go get github.com/ory/hydra@v1.11.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.8
This is the first release that contains the fix.
go get github.com/ory/hydra@v1.4.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization on the error_hint parameter to prevent malicious scripts from being executed. Additionally, you can configure your application to handle error messages in a way that does not expose sensitive information.
Conclusion
CVE-2019-8400 is a significant reflected XSS vulnerability in ORY Hydra that can compromise user security. It is crucial to update to version 1.4.8 or later to protect against potential exploits. For those unable to upgrade immediately, implementing workarounds can help mitigate risks.
See every vulnerability recorded for github.com/ory/hydra →
FAQ
CVE-2019-8400 is a vulnerability in ORY Hydra that allows for reflected cross-site scripting (XSS) through the error_hint parameter.
Exploitation of this vulnerability can lead to session hijacking, data theft, and other malicious actions against users of your application.
Versions of ORY Hydra prior to 1.4.8 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your Gopkg.lock file, you can determine if your application is affected by CVE-2019-8400.
Implement input validation and sanitization for the error_hint parameter, and consider alternative error handling methods to minimize exposure.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/hydra.
