Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
expressgateway/express-gateway
master @ a294cac
27
Fixes
0
CVEs
CRITICAL
Peak severity
45.8%
Coverage
Highlights
Auth Bypass: 20 prior fixes. Scrutinize any change in this area.
lib/policies/oauth2-introspect/oauth2-introspect.js: most-fixed (5 issues). Treat as high-risk during review.
22 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The token introspection policy had multiple severe logic flaws, including namespace collisions in passport strategies (causing endpoints to override each other), missing or incorrect scope authorization checks, and flawed authentication callback arguments.
Auth Bypass: Core authentication services returned success even when boolean verification checks failed, due to missing validation checks before destructuring or ignoring false status outcomes when returning the authenticated consumer.
Auth Bypass: JWT processing failed to enforce key constraints such as the presence of the issuer ('iss') claim, neglected to check if issuer credentials still exist in the database, and experienced strategy name collisions across multiple endpoints.