Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
go-pkgz/auth
master @ 54502ee
34
Fixes
1
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Auth Bypass: 18 prior fixes. Scrutinize any change in this area.
token/jwt.go: most-fixed (7 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Fragile custom token-parsing logic was prone to algorithm switching, unverified parsing phases, and missing expiration/claims validation, directly enabling complete authentication bypass.
CSRF: Flawed CSRF protection where ignored-methods checks relied on simple substring matching (strings.Contains) rather than exact slice matching, allowing attackers to forge arbitrary state-changing requests.
Auth Bypass: Inadequate validation of 'iss' and 'aud' claims in identity-provider tokens allowed token reuse and spoofed session issuance.