PT-2019-19013 · Ory · Ory Hydra

Published 2019-02-17 · Updated 2026-03-27 · CVE-2019-8400

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ORY Hydra versions prior to v1.0.0-rc.3+oryOS.9

Description The issue concerns a Reflected XSS that can be triggered via the oauth2/fallbacks/error endpoint, specifically through the error hint parameter.

Recommendations For versions prior to v1.0.0-rc.3+oryOS.9, update to v1.0.0-rc.3+oryOS.9 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-8400

GHSA-7V6R-W4R6-MHCH

GO-2026-4861

SUSE-SU-2026:1135-1

Affected Products

Ory Hydra

References · 151

• 🔥 https://hackerone.com/reports/456333 · Exploit
• 🔥 https://youtube.com/watch?v=RIyZLeKEC8E · Exploit
• https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-8400 · Security Note
• https://osv.dev/vulnerability/GHSA-7v6r-w4r6-mhch · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8400 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4861 · Vendor Advisory
• https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06 · Note
• https://github.com/ory/hydra · Note
• https://suse.com/security/cve/CVE-2026-4342 · Note
• https://suse.com/security/cve/CVE-2026-33758 · Note
• https://suse.com/security/cve/CVE-2026-25783 · Note
• https://suse.com/security/cve/CVE-2026-33191 · Note
• https://suse.com/security/cve/CVE-2026-32953 · Note