Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

keepassxreboot/keepassxc

              develop @ fa583f3
            

Fixes

CVEs

HIGH

Peak severity

52.8%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

src/browser/BrowserService.cpp: most-fixed (5 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The database unlocking mechanism failed to verify challenge-response results from hardware security tokens, permitting decryption to succeed without physical token confirmation. Additionally, modification of peripheral database settings could silently wipe master passwords in the UI without re-authenticating.

DLL Injection: On Windows, the application was susceptible to arbitrary code execution and DLL injection by loading untrusted modules when locating OpenSSL configurations and engines. The fix requires force-overriding OPENSSL_CONF and OPENSSL_MODULES to invalid paths.

Auth Bypass: The browser integration layer historically bypassed key security constraints, returning credentials without checking database association keys, ignoring expired database credentials, and failing to respect user-configured permissions during HTTP Basic Auth requests.