PT-2025-7498 · Hermes+1 · Hermes+1

Liad Eliyahu · Published 2025-02-20 · Updated 2025-03-13 · CVE-2025-1293

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hermes versions up to 0.4.0

Description The issue arises from improper validation of the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass.

Recommendations For Hermes versions up to 0.4.0, update to version 0.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the AWS ALB authentication mode until the update is applied.

Fix

Weakness Enumeration

CWE-1390

Related Identifiers

CVE-2025-1293

GHSA-VXM9-8MFW-VC6G

GO-2025-3475

OPENSUSE-SU-2025:14889-1

Affected Products

Aws Alb

Hermes

References · 44

• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1293 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1293 · Security Note
• https://osv.dev/vulnerability/GHSA-vxm9-8mfw-vc6g · Vendor Advisory
• https://github.com/hashicorp-forge/hermes/commit/e36d479616099bd0c8dfde6786ea671f112d9106 · Note
• https://github.com/hashicorp-forge/hermes · Note
• https://suse.com/security/cve/CVE-2025-23388 · Note
• https://suse.com/security/cve/CVE-2025-27144 · Note
• https://suse.com/security/cve/CVE-2025-25199 · Note
• https://suse.com/security/cve/CVE-2025-27155 · Note
• https://suse.com/security/cve/CVE-2025-1293 · Note
• https://suse.com/security/cve/CVE-2025-23387 · Note
• https://suse.com/security/cve/CVE-2025-27090 · Note