CVE-2025-1293
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
- EPSS probability
- 0.34%
- CWE
- CWE-1390
- Published
- 2025-02-20
- Last modified
- 2026-03-13
Affected products
- HashiCorp Tooling
Weakness type
Related vulnerabilities
- CVE-2026-77483 — SQL Server Elevation of Privilege Vulnerability
- CVE-2026-73025 — Windows iSCSI Security Feature Bypass Vulnerability
- CVE-2026-62895 — Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
- CVE-2026-80219 — Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft
- CVE-2026-73819 — Ebyte NA111-M Weak Authentication
- CVE-2026-44476 — Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
- CVE-2026-65098 — NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an...
- CVE-2026-68067 — Mira Hormone Monitor, Mira Android App Weak Authentication