CVE-2026-33504: 
NixOS vulnerability analysis and mitigation

CVE-2026-33504 is a SQL injection vulnerability in Ory Hydra, an OAuth 2.0 Server and OpenID Connect Provider, affecting all versions prior to 26.2.0. The flaw exists in the pagination implementation of three Admin APIs: listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers. Disclosed on March 20, 2026, via GitHub Security Advisory GHSA-r9w3-57w2-gch2, the vulnerability carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Ory Changelog).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Pagination tokens in Ory Hydra are encrypted using the secret defined in secrets.pagination; if this value is unset, Hydra falls back to secrets.system. An attacker who knows either secret can forge arbitrary pagination tokens and inject malicious SQL payloads into the token value, which is then passed unsanitized to the database layer when calling the affected Admin APIs. Exploitation requires: (1) access to one or more of the listed Admin APIs (directly or indirectly), (2) the ability to supply a raw pagination token to the API, and (3) knowledge of secrets.pagination or secrets.system (GitHub Advisory). A closely related vulnerability in Ory Kratos (CVE-2026-33503, GHSA-hgx2-28f8-6g2r) shares the same pagination-token SQL injection pattern, confirming the flaw is systemic across the Ory ecosystem (Kratos Advisory).

Successful exploitation allows an attacker to execute arbitrary SQL queries against the underlying database, resulting in full compromise of confidentiality (data exfiltration of OAuth clients, consent sessions, and JWT grant issuers), integrity (unauthorized data modification or deletion), and availability (database disruption). Because Hydra manages OAuth 2.0 tokens and OpenID Connect sessions, a successful attack could expose sensitive authentication infrastructure data, enable token forgery, or facilitate lateral movement into dependent services that rely on Hydra for authorization (GitHub Advisory).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.028% (0.000280), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement to know the secrets.pagination or secrets.system configuration value; however, installations that have not explicitly set secrets.pagination may use a predictable or default fallback, lowering the bar for attackers with knowledge of Hydra's default configuration (GitHub Advisory, Ory Changelog).

1. Reconnaissance: Identify Ory Hydra Admin API endpoints (e.g., /admin/clients, /admin/oauth2/consent/sessions, /admin/trust/grants/jwt-bearer/issuers) exposed directly or indirectly to the attacker's network.
2. Obtain or derive the pagination secret: Determine whether secrets.pagination is explicitly set. If not, the attacker may attempt to use the known default fallback value derived from secrets.system, which may be discoverable through configuration leaks or default deployments.
3. Forge a malicious pagination token: Using the known secret, craft a pagination token that, when decrypted by Hydra, contains SQL injection payloads (e.g., ' OR 1=1--, UNION-based queries, or time-based blind injection strings).
4. Submit the forged token: Pass the crafted token as the page_token parameter in a request to one of the vulnerable Admin APIs (e.g., GET /admin/clients?page_token=<forged_token>).
5. Extract data or cause damage: Observe the API response or use blind SQL injection timing techniques to enumerate database contents, exfiltrate OAuth client secrets, manipulate consent records, or disrupt database availability (GitHub Advisory).

• Network: Unusual or repeated requests to Hydra Admin API endpoints (/admin/clients, /admin/oauth2/consent/sessions, /admin/trust/grants/jwt-bearer/issuers) with abnormal or malformed page_token query parameters; unexpected outbound database connections or elevated query volumes.
• Logs: Hydra application logs showing SQL errors, unexpected query structures, or database exceptions triggered during pagination token processing; access log entries with base64-encoded or encrypted page_token values that differ structurally from legitimate tokens.
• Database: Unexpected queries containing SQL metacharacters (', --, UNION, SELECT) in pagination-related database calls; anomalous read or write activity on OAuth client, consent session, or JWT grant issuer tables.
• Process/Behavior: Sudden spikes in Admin API response times consistent with time-based blind SQL injection; database errors logged at unusual frequency during Admin API pagination operations (GitHub Advisory).

The primary remediation is to upgrade Ory Hydra to version 26.2.0 or later, which contains the fix for this vulnerability (GitHub Advisory, Ory Changelog). As an immediate interim measure before upgrading, configure a cryptographically secure random value for secrets.pagination (e.g., generated via openssl rand -base64 32) to prevent attackers from forging valid pagination tokens. Additionally, restrict network access to the Hydra Admin API so it is not directly or indirectly reachable by untrusted parties.

Ory published a security advisory and changelog announcement covering this vulnerability alongside related issues in Ory Kratos, Keto, Oathkeeper, and Polis, all addressed in the v26.2.0 release (Ory Changelog). The vulnerability was also detected by Qualys scanners and tracked by GitLab's advisory database, indicating broad awareness within the security tooling community (GitLab Advisory). No significant independent researcher commentary or social media discussion has been identified beyond standard vulnerability aggregator coverage.