Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

azure/azure-sdk-for-java

              main @ ccb0163
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

AadOidcIdTokenDecoderFactory: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Azure AD/B2C ID tokens were decoded without verifying the 'iss' and 'aud' claims, letting unauthorized tenants bypass authentication in multi-tenant configurations. This is linked to the critical vulnerability tracked in CVE-2026-33117.

Server-Side Request Forgery: Resolving unvalidated recording URLs directly via java.net.URL.openStream could allow SSRF attacks, requiring the introduction of a strict host allowlist validator.

Information Disclosure: Sensitive HTTP Authorization headers were forwarded to untrusted external hosts during HTTP redirect operations, requiring strict host and subdomain validation policies before headers are copied.