Cross-site Scripting (XSS)

Overview github.com/ory/hydra/oauth2 is an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the errorhint parameter. An attacker can execute arbitrary JavaScript in the context of the user's...

GO-2026-4861 Hydra has Reflected XSS via error_hint parameter in github.com/ory/hydra

Hydra has Reflected XSS via errorhint parameter in github.com/ory/hydra. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GHSA-7V6R-W4R6-MHCH Hydra has Reflected XSS via error_hint parameter

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

Hydra has Reflected XSS via error_hint parameter

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...