{"action":"Upgrade github.com/ory/kratos to 1.3.1-0.20260320110106-9d7085948039 or later.","affected":[{"fixed":"1.3.1-0.20260320110106-9d7085948039","introduced":"0"}],"component":"github.com/ory/kratos","cve_ids":["CVE-2026-33503"],"ecosystem":"Go","epss":0.00348,"exploited":false,"fixed_versions":["1.3.1-0.20260320110106-9d7085948039"],"ghsa_id":"GHSA-hgx2-28f8-6g2r","id":"tcs_01M5KGG65K3RSTW85GEQHB7A2C","modified_at":"2026-03-23T18:45:23.550070Z","published_at":"2026-03-23T18:16:18Z","references":["https://osv.dev/vulnerability/GO-2026-4801","https://github.com/ory/kratos/security/advisories/GHSA-hgx2-28f8-6g2r"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4801","url":"https://osv.dev/vulnerability/GO-2026-4801"}],"summary":"Ory Kratos has a SQL injection via forged pagination tokens in github.com/ory/kratos"}