CVE-2025-32435

CVE-2025-32435 affects Hydra, a CI service for Nix-based projects. The issue arises from evaluating untrusted non-flake nix code, which could allow access to secrets owned by hydra user/group. The description notes that signing keys owned by hydra-queue-runner and hydra-www are not affected. Publ...

Cross site scripting

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...