GHSA-vxm9-8mfw-vc6g

Hermes improperly validates a JWT

Source: GitHub Advisory Database (reviewed) High CVE-2025-1293

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp-forge/hermes	< 0.5.0	0.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-1293 advisory
https://github.com/hashicorp-forge/hermes/commit/e36d479616099bd0c8dfde6786ea671f112d9106 web
https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/733… web
https://github.com/hashicorp-forge/hermes package