Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

akveo/nebular

              master @ 0609554
            

Fixes

CVEs

HIGH

Peak severity

22.2%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

src/framework/auth/services/auth.service.ts: most-fixed (5 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Weak validation in `isAuthenticated` only checked for the existence of the token wrapper object instead of ensuring a non-empty string value was present, allowing unauthenticated states to bypass checks.

Auth Bypass: The `requireValidToken` configuration originally defaulted to false, allowing invalid or expired tokens to bypass authentication checks unless manually overridden by the developer.

Auth Bypass: An absence of strict checks on login/register responses allowed empty token objects to result in successful auth states, resolved by throwing a explicit NbAuthResult error.