Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
alexxiyang/shiro-redis
master @ df63786
3
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
org.crazycake.shiro.RedisSessionDAO: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Active user sessions could be bypassable or remain authorized via stale cached instances held in a ThreadLocal memory store. If expired sessions are not proactively cleaned up prior to CRUD operations, access control logic may evaluate against stale data.
Auth Bypass: When a user logs out, their cached authentication and authorization states must be evicted from Redis. If the key serializer fails to resolve key types like PrincipalCollection, the cache removal fails silently, leaving authorization privileges active in the cache.
Auth Bypass: Improper propagation of session timeouts to Redis allows sessions to persist indefinitely or drift from the configured Shiro session TTL, extending the window of opportunity for session hijacking.