Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
eclipse-che/che
main @ 0a559c2
53
Fixes
4
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 29 prior fixes. Scrutinize any change in this area.
multiuser/machine-auth: most-fixed (3 issues). Treat as high-risk during review.
26 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The application historically relied on easily spoofable prefix-based machine tokens ('machine' prefix checks) instead of cryptographically signed JWTs, exposing critical workspace boundaries to trivial unauthorized access.
Auth Bypass: WebSocket endpoints were vulnerable to authentication bypasses due to overly broad regex exclusions in the servlet filter mappings, allowing unauthenticated requests to slip past security filters.
Auth Bypass: A lack of unique workspace-specific signing keys meant that machine tokens could potentially be forged across different workspaces; key rotation and generation must be bounded per-workspace.