Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

a466350665/smart-sso

              master @ b87a872
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

smart-sso-client/src/main/java/com/smart/sso/client/filter/PermissionFilter.java: most-fixed (1 issue). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Authorization codes were not securely bound to the requesting client during token exchange, potentially allowing malicious clients to hijack authorization codes meant for legitimate clients.

Auth Bypass: When RPC communication with the SSO server failed, the client filter caught the exception silently and permitted access using an empty permission list instead of blocking unauthorized traffic.

Deserialization: Usage of Fastjson for payload parsing exposed the client utility to dangerous remote code execution (RCE) vectors via untrusted deserialization.