CVE-2026-55617 | hydro-dev Hydro up to 5.0.1 Session Recreation Logic base.ts authentication replay

September 15, 2026 Yanac

A vulnerability classified as critical was found in hydro-dev Hydro up to 5.0.1. Affected by this vulnerability is an unknown functionality of the file packages/hydrooj/src/service/layers/base.ts of the component Session Recreation Logic. The manipulation results in authentication bypass by capture-replay.

This vulnerability is known as CVE-2026-55617. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More