A flaw in Ory Hydra’s administrative pagination handling allows an attacker to supply a crafted token that is directly inserted into an SQL statement. This results in injection of arbitrary SQL code, providing the attacker with the ability to read, modify or delete database contents. The vulnerability does not grant arbitrary system code execution, but it does enable full compromise of the Hydra data store.

The issue affects Ory Hydra versions older than 26.2.0, specifically the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers admin APIs. Pagination tokens are encrypted with the secret configured in secrets.pagination; if that secret is not set, secrets.system is used instead. An attacker who can reach these APIs and knows the relevant secret can craft a token that triggers the injection.

The CVSS score of 7.2 indicates a serious level of risk, while the EPSS score is reported as less than 1% and the vulnerability is not present in the CISA KEV catalog. Exploitation requires direct access to one of the affected admin endpoints and knowledge of the pagination or system secret. If the secret is misconfigured or exposed, the attack path is straightforward; otherwise, the risk is lowered by secrecy of the key.