Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
grails/grails-spring-security-core
7.0.x @ 9ea4e21
2
Fixes
1
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
SpringSecurityCoreGrailsPlugin.groovy: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Delayed initialization of SecurityContextHolder strategies allows a race condition where early-defined Spring beans load under an incorrect security context propagation strategy, leading to authorization bypasses.
Insecure Dependency: Importing local or unverified GPG keys during artifact verification poses a supply-chain risk if key validation is bypassed or if keys are acquired over insecure channels.