CVE-2025-1293
HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass
Summary
HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass
Original description
The description as published by the source.
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- web discuss.hashicorp.com