{"id":"CVE-2019-8400","details":"ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.","aliases":["GHSA-7v6r-w4r6-mhch","GO-2026-4861"],"modified":"2026-08-03T02:12:54.332304068Z","published":"2019-02-17T06:29:00.643Z","related":["SUSE-SU-2026:1135-1","openSUSE-SU-2026:21483-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_FIELD","vendor_product":"ory:hydra","cpes":["cpe:2.3:a:ory:hydra:0.10.0:alpha10:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha11:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha12:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha13:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha14:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha15:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha16:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha17:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha18:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha19:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha20:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha21:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha5:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha6:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha7:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha8:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.10.0:alpha9:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.1:beta2:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.1:beta3:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.1:beta4:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.4.2:alpha1:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.4.2:alpha2:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.4.2:alpha3:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:0.4.2:alpha4:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta6:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta7:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta8:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:beta9:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:ory:hydra:1.0.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"0.1-beta2"},{"last_affected":"0.1-beta3"},{"last_affected":"0.1-beta4"},{"last_affected":"0.4.2-alpha1"},{"last_affected":"0.4.2-alpha2"},{"last_affected":"0.4.2-alpha3"},{"last_affected":"0.4.2-alpha4"},{"last_affected":"0.10.0-alpha1"},{"last_affected":"0.10.0-alpha10"},{"last_affected":"0.10.0-alpha11"},{"last_affected":"0.10.0-alpha12"},{"last_affected":"0.10.0-alpha13"},{"last_affected":"0.10.0-alpha14"},{"last_affected":"0.10.0-alpha15"},{"last_affected":"0.10.0-alpha16"},{"last_affected":"0.10.0-alpha17"},{"last_affected":"0.10.0-alpha18"},{"last_affected":"0.10.0-alpha19"},{"last_affected":"0.10.0-alpha2"},{"last_affected":"0.10.0-alpha20"},{"last_affected":"0.10.0-alpha21"},{"last_affected":"0.10.0-alpha3"},{"last_affected":"0.10.0-alpha4"},{"last_affected":"0.10.0-alpha5"},{"last_affected":"0.10.0-alpha6"},{"last_affected":"0.10.0-alpha7"},{"last_affected":"0.10.0-alpha8"},{"last_affected":"0.10.0-alpha9"},{"last_affected":"1.0.0-beta1"},{"last_affected":"1.0.0-beta2"},{"last_affected":"1.0.0-beta3"},{"last_affected":"1.0.0-beta4"},{"last_affected":"1.0.0-beta5"},{"last_affected":"1.0.0-beta6"},{"last_affected":"1.0.0-beta7"},{"last_affected":"1.0.0-beta8"},{"last_affected":"1.0.0-beta9"},{"last_affected":"1.0.0-rc1"},{"last_affected":"1.0.0-rc2"}]}]},"references":[{"type":"ADVISORY","url":"https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk"},{"type":"ADVISORY","url":"https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06"},{"type":"REPORT","url":"https://hackerone.com/reports/456333"},{"type":"FIX","url":"https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3"},{"type":"EVIDENCE","url":"https://www.youtube.com/watch?v=RIyZLeKEC8E"}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}