Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

abpframework/abp

              dev @ 8665ce0
            

135

Fixes

CVEs

CRITICAL

Peak severity

27.5%

Coverage

Highlights

Auth Bypass: 85 prior fixes. Scrutinize any change in this area.

Volo.Abp.Identity: most-fixed (11 issues). Treat as high-risk during review.

68 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inconsistent or missing pre-sign-in verification and lack of dynamic tenant synchronization during OpenIddict login flows allowed host-shared users to bypass authentication checks. This was resolved by forcing proper tenant switching and replacing standard CanSignIn checks with comprehensive PreSignInCheck validations.

Remote Code Execution: The Scriban template rendering engine allowed reflection escape routes and method invocation, leading to potential arbitrary code execution. The fix introduced a MemberFilter allowlist restricting resolution to public properties only.

Open Redirect: Improper validation of the returnUrl parameter across account management components, particularly registration, allowed attackers to construct crafted URLs redirecting users to arbitrary external domains (tracked as CVE-2025-65581).