Security context

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

verify.go: most-fixed (5 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Insecure handling of cryptographic signatures and verification configurations can allow attackers to bypass key token validation boundaries. For example, failing to default to RS256 when SupportedSigningAlgs is empty allows arbitrary asymmetric signature algorithms, while lack of signature enforcement on distributed claim endpoints allows unverified claims to be trusted.

Auth Bypass: Vulnerabilities in the underlying cryptographic parsing phase, such as passing unrestricted algorithms to the parser, can lead to signature verification bypasses. Ensuring strict, allowlisted cryptographic algorithm enforcement directly in the parsing library is necessary to prevent malformed or weak signatures from being accepted.

Auth Bypass: Missing or insufficient validation of standard token claims (such as expiration 'exp' and 'not before' 'nbf') allows expired, pre-active, or replayed tokens to bypass lifecycle validations, leading to unauthorized sessions.