Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googleapis/google-api-java-client

              main @ 81fc9f5
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

google-api-client: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The client library parsed the legacy 'verified_email' field instead of the standard OIDC 'email_verified' claim. Applications relying on the library to ensure email verification before granting access could suffer authentication bypasses if trust was established based on unverified email claims.

SSRF: Requests targeting the Google Compute Engine (GCE) metadata server lacked proper validation headers. Failing to mandate headers like 'Metadata-Flavor: Google' allowed attackers to exploit SSRF vectors to query sensitive instance metadata via unvalidated redirect paths or proxy configurations.

Auth Bypass: Delegating signature validation incorrectly to super.verify in the GoogleIdTokenVerifier class bypassed crucial payload validation checks, leading to flawed signature verification behavior for ID tokens.