CVE-2025-1293

8.2 highEPSS 0.3%

High (8.2) in hashicorp hermes. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp-forge/hermes 0.5.0.

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.

Severity

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-1390
Published: 2025-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hashicorp:hermes

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vxm9-8mfw-vc6g	Go	github.com/hashicorp-forge/hermes	<0.5.0	0.5.0
GO-2025-3475	Go	github.com/hashicorp-forge/hermes	<0.5.0	0.5.0

References

https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371

Check your stack JSON