Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googleapis/google-auth-library-ruby

              main @ 78bd92f
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

Google::Auth::ExternalAccount::AwsCredentials: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Using an incorrect HTTP verb (GET instead of PUT) for AWS IMDSv2 token acquisition can result in failure to retrieve credentials or fallback to weaker IMDSv1 mechanisms, leading to local auth bypass.

Information Disclosure: Transmitting sensitive OAuth access and refresh tokens using GET requests with query parameters exposes secrets to local HTTP logs, reverse proxies, and referer headers.

Command Injection: Executing helper tools like gcloud without isolating standard input and error streams can cause the process to hang or prompt for interactive console authentication in unexpected contexts.