Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googleapis/google-auth-library-nodejs

              main @ a95b827
            

Fixes

CVEs

HIGH

Peak severity

75.0%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

src/auth/oauth2client.ts: most-fixed (4 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in JWT token signature verification, such as failing to check if a key ID (kid) exists in the retrieved certificates map before calling verify, allow malformed or untrusted tokens to bypass validation.

SSRF: Failing to restrict external or cloud metadata requests to legitimate link-local addresses allows attackers to exploit the token-retrieval flow to exfiltrate AWS credentials via SSRF.

SSRF: Lack of strict hostname and domain verification on token exchange and service account impersonation endpoints allows attackers to divert credential requests to arbitrary external servers.