VDB
GHSA-7v6r-w4r6-mhch
GHSA-7v6r-w4r6-mhch
PUBLISHED
CVSS 6.099999904632568 MEDIUM
Hydra has Reflected XSS via error_hint parameter
Record from GitHub Advisory Database · Published May 14, 2022
github.com/ory/hydra is fixed in 1.4.8 (Go Modules)
Hydra has Reflected XSS via error_hint parameter
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/ory/hydra | Go Modules | 1.4.8 |
Risk scores
CVSS 3.0
6.099999904632568
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| github.com | ory/hydra | 0 |
Timeline
- May 14, 2022 CVE Published
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-7v6r-w4r6-mhch
vulnetix vdb fixes GHSA-7v6r-w4r6-mhchOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-7v6r-w4r6-mhch/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/ory/hydra package
- https://www.youtube.com/watch?v=RIyZLeKEC8E url
- https://nvd.nist.gov/vuln/detail/CVE-2019-8400 advisory
- https://hackerone.com/reports/456333 url
- https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06 url
- https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3 url
- https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk url