Ory Hydra, an OAuth 2.0 Server and OpenID Connect Provider, contains a flaw in the pagination logic for the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs. When a pagination token is encrypted with a secret that the attacker can learn, the token can be crafted to inject raw SQL. This classic SQL injection (CWE‑89) lets an attacker run arbitrary SQL statements against Hydra’s database, potentially exposing or destroying confidential data and compromising system integrity.

The vulnerability affects all Ory Hydra installations running a version earlier than 26.2.0. The Admin APIs must be reachable and the attacker must know either the configured secrets.pagination value or, if that is unset, the fallback secrets.system value. Any user or service that can call these endpoints with a forged token is subject to the risk.

Based on the description, the likely attack vector is remote via the admin API: an attacker may send a crafted pagination token over the network to an exposed endpoint. The exploit requires knowledge of the secret used to encrypt pagination tokens, and it immediately allows arbitrary SQL execution on the database. A CVSS score of 7.2 classifies the flaw as high impact, and although EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, the potential for full database compromise makes it a serious concern. Prompt remediation is therefore recommended.