Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
authgear/authgear-server
main @ e316323
253
Fixes
0
CVEs
CRITICAL
Peak severity
51.3%
Coverage
Highlights
Auth Bypass: 175 prior fixes. Scrutinize any change in this area.
pkg/lib/oauth/handler/handler_token.go: most-fixed (14 issues). Treat as high-risk during review.
135 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The SAML service provider and identity provider bindings contained vulnerabilities where cryptographic signature validation could be bypassed entirely if signing certificates were missing or not correctly verified, leading to potential authentication bypasses.
Authentication Bypass: State validation bugs allowed step-skipping when authenticators created during alternative flows were misclassified, letting attackers bypass primary authentication constraints.
Auth Bypass: A critical authentication bypass existed where the submitted verification code was not validated against the expected OTP, allowing arbitrary code submissions to succeed.