CVE-2026-33504: Ory Hydra SQL Injection Vulnerability

CVE-2026-33504 Overview

CVE-2026-33504 is a SQL injection vulnerability affecting Ory Hydra, an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs are vulnerable to SQL injection due to flaws in the pagination implementation. Pagination tokens are encrypted using the secret configured in secrets.pagination, and if this value is not set, Hydra falls back to using secrets.system. An attacker who knows this secret can craft malicious tokens that lead to SQL injection, enabling arbitrary SQL query execution.

Critical Impact
Attackers with knowledge of pagination or system secrets can execute arbitrary SQL queries through forged pagination tokens, potentially leading to complete database compromise, data exfiltration, and unauthorized data manipulation.

Affected Products

Ory Hydra versions prior to 26.2.0
Systems with accessible Admin APIs (listOAuth2Clients, listOAuth2ConsentSessions, listTrustedOAuth2JwtGrantIssuers)
Deployments where secrets.pagination or secrets.system values are known to attackers

Discovery Timeline

2026-03-26 - CVE-2026-33504 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33504

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from insufficient input validation in Ory Hydra's pagination implementation. The affected Admin APIs accept pagination tokens that, when properly encrypted with the known secret, are trusted and processed without adequate sanitization. This creates a direct path for SQL injection when an attacker possesses the encryption secret.

The vulnerability requires network access and high privileges to exploit, as the attacker must have knowledge of the secrets.pagination or secrets.system configuration values. However, once these prerequisites are met, the attack complexity is low, and successful exploitation can result in complete confidentiality, integrity, and availability impact to the underlying database.

Root Cause

The root cause lies in Ory Hydra's pagination token handling mechanism. The application trusts the contents of pagination tokens after decryption without performing proper SQL parameterization or input validation. The encryption mechanism uses either secrets.pagination or falls back to secrets.system, creating two potential attack vectors if either secret is compromised.

When an attacker obtains access to these secrets—whether through configuration exposure, insider access, or other means—they can forge arbitrary pagination tokens containing SQL injection payloads that bypass the encryption-based authentication.

Attack Vector

This vulnerability is exploitable via network access to the Ory Hydra Admin APIs. The attack requires the following conditions:

One or more of the affected Admin APIs (listOAuth2Clients, listOAuth2ConsentSessions, or listTrustedOAuth2JwtGrantIssuers) must be directly or indirectly accessible to the attacker
The attacker must be able to pass a raw pagination token to the affected API
The attacker must know either the secrets.pagination value or, if that is not configured, the secrets.system value

With these prerequisites satisfied, an attacker can craft malicious pagination tokens containing SQL injection payloads. Since the tokens are properly encrypted with the legitimate secret, the application accepts them as valid and processes the embedded SQL commands directly against the database.

Detection Methods for CVE-2026-33504

Indicators of Compromise

Unusual or malformed pagination token patterns in Admin API request logs
Unexpected SQL errors or database exceptions correlating with pagination API calls
Anomalous database queries originating from Hydra application connections
Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

Monitor Admin API endpoints for unusual pagination token submissions, particularly tokens with suspicious character patterns after decryption
Implement database query logging and alerting for anomalous SQL statements from Hydra connections
Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in API requests
Review access logs for the affected endpoints (/admin/clients, /admin/oauth2/auth/sessions/consent, /admin/trust/grants/jwt-bearer/issuers)

Monitoring Recommendations

Enable comprehensive logging for all Admin API endpoints in Ory Hydra
Configure database audit logging to capture all queries from the Hydra application service account
Set up alerts for SQL errors or exceptions that may indicate injection attempts
Monitor for configuration file access or exposure that could reveal pagination or system secrets

How to Mitigate CVE-2026-33504

Immediate Actions Required

Immediately configure a custom value for secrets.pagination by generating a cryptographically secure random secret
Rotate secrets.system if it may have been exposed or is being used as a fallback for pagination
Restrict network access to Admin APIs to trusted administrative networks only
Review access logs for evidence of exploitation attempts

Patch Information

Upgrade Ory Hydra to version 26.2.0 or later, which contains the fix for this SQL injection vulnerability. The patch addresses the improper handling of pagination tokens by implementing proper input validation and SQL parameterization.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

Generate a new cryptographically secure random value for secrets.pagination configuration
Ensure Admin APIs are not publicly accessible by implementing network segmentation
Deploy a Web Application Firewall (WAF) with SQL injection detection rules in front of Admin endpoints
Implement additional authentication and authorization controls for Admin API access

bash

# Configuration example - Generate a secure pagination secret
# Generate a 32-byte random secret for pagination tokens
openssl rand -base64 32

# Example Hydra configuration (hydra.yaml)
# secrets:
#   pagination: "<generated-secure-random-value>"
#   system:
#     - "<existing-system-secret>"