CVE-2026-33504
SQL Injection in Ory Hydra Admin APIs via Pagination Tokens
Publication date: 2026-03-26
Last updated on: 2026-04-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ory | hydra | to 26.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to execute arbitrary SQL queries on the backend database, compromising the confidentiality, integrity, and availability of data.
Such a compromise can lead to unauthorized access, modification, or deletion of sensitive data, which may result in violations of data protection regulations like GDPR and HIPAA that require strict controls over data confidentiality and integrity.
Therefore, if exploited, this vulnerability could negatively impact compliance with these common standards and regulations by exposing protected data or disrupting its availability.
Can you explain this vulnerability to me?
CVE-2026-33504 is a high-severity SQL injection vulnerability in Ory Hydra's Admin APIs, specifically affecting the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers endpoints.
The vulnerability arises from a flaw in the pagination implementation where pagination tokens are encrypted using a secret configured in `secrets.pagination`. If this secret is not set, Hydra uses `secrets.system` instead.
An attacker who knows either of these secrets can craft malicious pagination tokens that lead to SQL injection attacks by passing these tokens to the vulnerable APIs.
Exploitation requires that the attacker has direct or indirect access to the affected Admin APIs, can supply a raw pagination token, and knows the secret used for token encryption.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary SQL queries on the backend database of Ory Hydra.
The impact includes compromising the confidentiality, integrity, and availability of data managed by the affected system.
Because the attacker can run arbitrary SQL commands, they could potentially access sensitive information, modify or delete data, or disrupt service availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the vulnerable Admin APIs (listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers) are accessible and if the pagination tokens can be manipulated.
Since exploitation requires knowledge of the secrets used for pagination tokens, detection can include verifying the configuration of `secrets.pagination` and `secrets.system` values.
Commands to help detect the vulnerability might include:
- Checking the version of Ory Hydra to see if it is prior to 26.2.0 (e.g., `hydra version`).
- Testing access to the vulnerable Admin API endpoints to see if they respond to requests with pagination tokens.
- Reviewing the configuration files or environment variables for the presence and values of `secrets.pagination` and `secrets.system`.
- Using network monitoring tools to detect suspicious or malformed pagination tokens being sent to the Admin APIs.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation steps are:
- Configure a custom, cryptographically secure value for `secrets.pagination` by generating a strong secret, for example using the command: `openssl rand -base64 32`.
- Upgrade Ory Hydra to version 26.2.0 or later, where the vulnerability has been fixed.