CVE-2025-1293 — HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass

CVE-2025-1293

HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass PUBLISHED

Description (CNA)

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Tooling	affected 0 before 0.5.0

CWE

CWE-1390

References

https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.