Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dromara/lamp-cloud
java17/5.x @ ee893ed
24
Fixes
1
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 10 prior fixes. Scrutinize any change in this area.
lamp-oauth: most-fixed (2 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Session data confusion and leaky tenant switches allowed unauthorized access when migrating between multi-tenant contexts. Session variables must be token-bound rather than shared.
Authentication Bypass: User password validation checks were conditionally skipped during authentication, permitting direct authentication bypass without valid credentials.
Authentication Bypass: Hardcoded cryptographic keys used for JWT token signing allow external attackers to forge credentials and completely bypass security controls (CVE-2023-31579).