CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

CVE-2026-33504

Ory Hydra is affected by a SQL injection vulnerability in Admin APIs (listOAuth2Clients, listOAuth2ConsentSessions, listTrustedOAuth2JwtGrantIssuers) due to flawed pagination token handling. Tokens are encrypted with secrets.pagination (fallback to secrets.system if not set); an attacker who know...