CVE-2025-1293: HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass
Published Feb 20, 2025
·Updated
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
Affected Software
3 affected componentsFixes available
HashiCorp Hermes<0.5.0
go/github.com/hashicorp-forge/hermes<0.5.0
0.5.0
HashiCorp Hermes<0.5.0
Event History
Feb 20, 2025
CVE Published
via MITRE·12:28 AM
Data Sourced
via MITRE·12:28 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 AM
Affected Software
Advisory Published
via GitHub·03:32 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-1293?
CVE-2025-1293 is considered a medium severity vulnerability due to its potential for authentication bypass.
2
How do I fix CVE-2025-1293?
To fix CVE-2025-1293, upgrade Hermes to version 0.5.0 or later.
3
What software is affected by CVE-2025-1293?
CVE-2025-1293 affects Hermes versions up to and including 0.4.0.
4
What type of vulnerability is CVE-2025-1293?
CVE-2025-1293 is an authentication bypass vulnerability related to improper JWT validation.
5
What does CVE-2025-1293 impact regarding security?
CVE-2025-1293 impacts the security of AWS ALB authentication when used with Hermes, allowing unauthorized access.