oathkeeper

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. It follows the BeyondCorp model designed by Google and secures applications in Zero-Trust...

kratos

Chat · Discusiones · Boletín informativo · Documentación · Probar Ory Network · Empleos Ory Kratos es un sistema de gestión de identidad y usuarios API-first para aplicaciones nativas de la nube. Centraliza los flujos de inicio de sesión, registro, recuperación, verificación y gestión de perfiles...

talos

Chat · Debates · Boletín · Documentación · Probar Ory Network · Empleos Ory Talos es un servidor de claves de API escalable y seguro optimizado para verificación de baja latencia, escalado horizontal y operaciones predecibles. Sigue las mejores prácticas de seguridad establecidas para claves de A...

hydra

聊天 · 讨论 · 新闻通讯 · 文档 · 试用 Ory Network · 职位 Ory Hydra 是一个经过加固、通过 OpenID 认证的 OAuth 2.0 服务器和 OpenID Connect 提供程序，针对低延迟、高吞吐量和低资源 消耗进行了优化。它通过登录和 同意应用连接到您现有的身份提供商，让您对用户界面和体验拥有绝对控制权。 什么是 Ory Hydra？ 为什么选择 Ory Hydra OAuth2 和 OpenID Connect：开放标准 OpenID Connect 认证 部署选项 在 Ory Network 上使用 Ory Hydra 自托管 Ory Hyd...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: bento-fips, argo-events-fips, peerdb-flow, atlantis, kubernetes-event-exporter, kyverno-policy-reporter-fips, kubernetes-event-exporter-fips, goreleaser, atlantis-fips, kyverno-policy-reporter, bento, ory-kratos-fips, argo-cd-fips, argo-rollouts-fips, argo-cd,...

GHSA-GXHX-2686-5H9G vulnerabilities

Vulnerabilities for packages: bento-fips, argo-events-fips, peerdb-flow, atlantis, kubernetes-event-exporter, kyverno-policy-reporter-fips, kubernetes-event-exporter-fips, goreleaser, atlantis-fips, kyverno-policy-reporter, bento, ory-kratos-fips, argo-cd-fips, argo-rollouts-fips, argo-cd,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: azure-service-operator-fips, sftpgo-plugin-eventsearch, cloudnative-pg-fips, openfga-fips, src, cloudprober-fips, step-issuer, zitadel, commercial-expanso-edge, spqr, k3s, rke2-cloud-provider, seaweedfs, temporal-server-fips, step-issuer-fips, kubeflow-pipelines,...

SUSE CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

SUSE CVE-2026-33496

ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The oauth2introspection authenticator cache does not distingui...

SUSE CVE-2026-33503

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Kratos is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configur...

SUSE CVE-2026-33504

Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens ar...

SUSE CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

CVE-2026-33506

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting XSS vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter callbackUrl,...

CVE-2026-33495

ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper is often deployed behind other components like CDNs, WAFs, or reverse proxies. Depending on the setup, another component might forward the...

CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

CVE-2026-33503

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Kratos is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configur...

GO-2026-4861 Hydra has Reflected XSS via error_hint parameter in github.com/ory/hydra

Hydra has Reflected XSS via errorhint parameter in github.com/ory/hydra. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

CVE-2026-33506

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting XSS vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter callbackUrl,...

CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

CVE-2026-33506 DOM-Based XSS in Ory Polis Login Page

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting XSS vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter callbackUrl,...