Hermes improperly validates a JWT

HIGH 8.2CVE-2025-1293 · GHSA-vxm9-8mfw-vc6g · GO-2025-3475 · Published 20/02/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp-forge/hermes Go	`< 0.5.0`	`0.5.0`
hermes hashicorp	`< 0.5.0`	`0.5.0`

Description

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-1293 · ADVISORY
hashicorp-forge/hermes commit e36d479 · WEB
discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371 · WEB
hashicorp-forge/hermes · PACKAGE
GitHub Advisory GHSA-vxm9-8mfw-vc6g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free