Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

golang/oauth2

              master @ 4d954e6
            

Fixes

CVEs

HIGH

Peak severity

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

google/internal/externalaccount: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Attackers could manipulate AWS metadata server configuration URLs to trigger SSRF and extract sensitive instance metadata credentials. The fix restricts URLs targeting the metadata service to strict link-local addresses.

SSRF: Insecurely configured TokenURL and ServiceAccountImpersonationURL properties allowed arbitrary outbound requests during STS exchange. Safe domain validation via regular expressions is now enforced to restrict target hosts to trusted Google APIs.

Auth Bypass: OAuth2 client authorization style caching lacked Client ID segregation, leading to potential style mismatches and authorization leaks when multiple clients hit the same token endpoint. The fix includes the client ID in the cache key.