{"action":"Upgrade github.com/ory/kratos to 1.3.1-0.20260320110106-9d7085948039 or later.","affected":[{"fixed":"1.3.1-0.20260320110106-9d7085948039","introduced":"0"}],"component":"github.com/ory/kratos","cve_ids":["CVE-2026-33503"],"ecosystem":"Go","epss":0.00262,"exploited":false,"fixed_versions":["1.3.1-0.20260320110106-9d7085948039"],"ghsa_id":"GHSA-hgx2-28f8-6g2r","id":"tcs_01M5KFCJH957KXM3NTE5CVYGSV","modified_at":"2026-03-27T21:20:15.936696Z","published_at":"2026-03-20T20:54:54Z","references":["https://osv.dev/vulnerability/GHSA-hgx2-28f8-6g2r","https://github.com/ory/kratos/security/advisories/GHSA-hgx2-28f8-6g2r","https://nvd.nist.gov/vuln/detail/CVE-2026-33503","https://github.com/ory/kratos"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-hgx2-28f8-6g2r","url":"https://osv.dev/vulnerability/GHSA-hgx2-28f8-6g2r"}],"summary":"Ory Kratos has a SQL injection via forged pagination tokens"}