Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

iflytek/skillhub

              main @ 8413ee3
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Auth Bypass: 39 prior fixes. Scrutinize any change in this area.

server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/AuthController.java: most-fixed (5 issues). Treat as high-risk during review.

30 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: CLI Bearer tokens previously failed open on invalid or expired credentials, allowing requests to fallback to anonymous access rather than failing closed. This allowed unauthorized users to bypass endpoint controls.

Auth Bypass: Active user sessions were not invalidated upon user account deactivation, permitting disabled users to continue making authenticated requests because their cached roles and sessions remained valid.

Path Traversal: Inadequate path validation during zip archive extraction allowed zip-slip directory traversal vulnerabilities, exposing the underlying filesystem to arbitrary file writes.