Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

damienbod/angular-auth-oidc-client

              main @ 4723c0f
            

Fixes

CVEs

HIGH

Peak severity

48.6%

Coverage

Highlights

Auth Bypass: 29 prior fixes. Scrutinize any change in this area.

projects/angular-auth-oidc-client/src/lib/validation/token-validation.service.ts: most-fixed (6 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in WebCrypto API parameter configurations (such as swapping algorithms and parameters) and payload parsing previously led to incorrect signature verifications.

Auth Bypass: Failing to strictly validate that claims in a refreshed token match the original, or omitting the 'azp' claim validation when multiple audiences are present, violates the OIDC specification and introduces token spoofing risks.

Auth Bypass: Logical inversions in token-checking helper functions and failure to evaluate both ID and access token expirations jointly have previously allowed expired tokens to maintain active sessions.