CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5300 – Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra
https://notcve.org/view.php?id=CVE-2020-5300
06 Apr 2020 — In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulne... • https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3 • CWE-294: Authentication Bypass by Capture-replay •
CVSS: 6.1EPSS: 0%CPEs: 129EXPL: 2CVE-2019-8400
https://notcve.org/view.php?id=CVE-2019-8400
17 Feb 2019 — ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. ORY Hydra, en versiones anteriores a la v1.0.0-rc.3+oryOS.9, tiene Cross-Site Scripting (XSS) reflejado mediante el parámetro error_hint en oauth2/fallbacks/error error_hint. • https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •