What is GHSA-7v6r-w4r6-mhch?

GHSA-7v6r-w4r6-mhch is a security advisory published by GitHub Security Advisories with Medium severity. Hydra has Reflected XSS via error_hint parameter

Which CVE IDs does GHSA-7v6r-w4r6-mhch cover?

GHSA-7v6r-w4r6-mhch covers the following CVE IDs: CVE-2019-8400. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7v6r-w4r6-mhch?

GHSA-7v6r-w4r6-mhch has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7v6r-w4r6-mhch?

GHSA-7v6r-w4r6-mhch affects 1 product, including: go/github.com/ory/hydra:\u003c 1.4.8.

GHSA-7v6r-w4r6-mhchMediumCVSS 6.1

Hydra has Reflected XSS via error_hint parameter

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

March 26, 2026

🔗 CVE IDs covered (1)

CVE-2019-8400 →

📋 Description

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.

🎯 Affected products1

go/github.com/ory/hydra:< 1.4.8

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2019-8400
https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3
https://hackerone.com/reports/456333
https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk
https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06
https://www.youtube.com/watch?v=RIyZLeKEC8E
https://github.com/advisories/GHSA-7v6r-w4r6-mhch