Security context

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

lib/grant/token.js: most-fixed (3 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Missing conditional validation on the output of exchange callbacks allows invalid or unissued tokens to silently fall through to next() instead of being explicitly rejected, bypassing authorization controls.

Denial of Service: Synchronous exceptions thrown inside user-defined exchange and validation callbacks crash the Node.js process. These callback invocations must be wrapped in try-catch blocks to prevent denial of service.

Auth Bypass: Lack of strict type-checking on incoming query parameters like client_id and scope allows attackers to pass non-string values (such as arrays), resulting in type confusion, bypass of client verification, or crashes.