Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getfider/fider

              main @ 03009d1
            

Fixes

CVEs

CRITICAL

Peak severity

48.6%

Coverage

Highlights

Auth Bypass: 23 prior fixes. Scrutinize any change in this area.

app/handlers/oauth.go: most-fixed (9 issues). Treat as high-risk during review.

29 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Mass Assignment: Unsafe JSON unmarshalling allowed clients to overwrite internal verification codes and security keys, leading to complete authentication bypass. Future APIs must enforce strict model separation or explicit JSON ignoring.

Auth Bypass: User lookups by email during OAuth callback lacked tenant isolation checks, presenting a severe risk of cross-tenant account takeover in multi-tenant environments. Lookups must always be scoped by tenant ID.

SSRF: Lack of resolve-time validation for outbound URLs in custom OAuth providers and webhooks allowed interaction with private, loopback, and link-local IP addresses.