CVE-2026-33504: Ory Hydra SQL Injection via Forged Pagination Tokens
Summary
CVE-2026-33504: Ory Hydra has a SQL injection via forged pagination tokens. Affects github.com/ory/hydra versions < 2.3.1-0.20260320110106-0b84568fffcc. Fixed in 2.3.1-0.20260320110106-0b84568fffcc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ory Hydra is an open-source OAuth2 and OpenID Connect server that provides secure and scalable identity management. It allows developers to implement authentication and authorization flows in their applications. The package is designed to handle sensitive user data and requires robust security measures to protect against potential vulnerabilities. However, it has been found to be susceptible to SQL injection attacks due to flaws in its pagination implementation.
Vulnerability Detail
The vulnerability arises from the Admin APIs in Ory Hydra, specifically in the endpoints: listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers. These APIs are vulnerable to SQL injection because pagination tokens can be forged by attackers who know the secret used for encryption. If the attacker can access these APIs and has knowledge of the configured secrets, they can craft malicious tokens that allow them to execute arbitrary SQL queries, potentially compromising the database and exposing sensitive information.
How To Fix
Latest published version: v1.11.10 as of 23 Oct 2026
go get github.com/ory/hydra@v1.11.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.1-0.20260320110106-0b84568fffcc
This is the first release that contains the fix.
go get github.com/ory/hydra@v2.3.1-0.20260320110106-0b84568fffccTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the Admin APIs are not directly accessible to untrusted users. Limit access to these endpoints and monitor for any suspicious activity until the patch can be applied.
Conclusion
The SQL injection vulnerability in Ory Hydra poses a significant risk to applications using this package. By understanding the nature of the vulnerability and taking immediate steps to configure secrets and upgrade to the patched version, developers can protect their applications from potential attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for github.com/ory/hydra →
FAQ
The vulnerability is a SQL injection that allows attackers to execute arbitrary SQL queries through forged pagination tokens.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
An attacker could gain unauthorized access to sensitive data, manipulate database records, or compromise the integrity of the application.
Yes, a patch is available in version 2.3.1-0.20260320110106-0b84568fffcc of Ory Hydra.
If you cannot upgrade immediately, implement access controls to restrict access to the vulnerable Admin APIs and monitor for unusual activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/hydra.
