CVE-2025-1293CWE-1390

HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass

High · published February 20, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.1th percentile
Weakness
CWE-1390 · Weak Authentication
Published
2025-02-20T00:28Z
EPSS history
Timeline
  • 20 FEB 00:28Z
    HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass
    cvelistv5