hydra
v26.2.0Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
- Maintenance
- SlowBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 3 advisories1 high, 1 medium, 1 low · Scorecard 5.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
17.7k stars · 1.6k forks · 91 open issues · last release 7 months ago · data checked 56 minutes ago
Security advisories
All advisories on GitHubThe 3 most recent advisories published by the maintainers: 1 high, 1 medium, 1 low. Check the patched version against the one you run.
- highCVE-2026-33504Mar 20, 2026SQL injection via forged pagination tokens
- Affected
- v25.4.0
- Patched in
- v26.2.0
- mediumCVE-2020-5300Apr 2, 2020Disallow replay of `private_key_jwt` by blacklisting JTIs
- Affected
- v1.3.2+oryOS.17
- Patched in
- v1.4.0+oryOS.17
- lowJun 5, 2019XSS vulnerability in `hydra token user` templates
- Affected
- <=1.0.0-rc.14
- Patched in
- 1.0.0-rc.15