HIGH7.2Go
GHSA-hgx2-28f8-6g2r· CVE-2026-33503, GO-2026-4801Ory Kratos has a SQL injection via forged pagination tokens
Modified: 3/27/2026
package
Go/github.com/ory/kratos
pkg:go/github.com/ory/kratos
MEDIUM4.4Go
GHSA-wc43-73w7-x2f5· CVE-2024-45042, GO-2024-3160Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials
Modified: 9/26/2024
—Go
GO-2024-3160· CVE-2024-45042, GHSA-wc43-73w7-x2f5Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials in github.com/ory/kratos
Modified: 3/3/2026
—Go
GO-2026-4801· CVE-2026-33503, GHSA-hgx2-28f8-6g2rOry Kratos has a SQL injection via forged pagination tokens in github.com/ory/kratos
Modified: 3/23/2026