Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
knowm/xchange
develop @ dba8add
4
Fixes
50
CVEs
HIGH
Peak severity
Highlights
Authentication Bypass: 1 prior fix. Scrutinize any change in this area.
xchange-core: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Thread Safety: Stateful cryptographic Mac instances were shared across multiple threads without isolation, risking concurrent state corruption and cryptographic failures. The fix introduced ThreadLocal storage to ensure unique instances per thread.
Race Condition: Cryptographic signature generation on the shared Mac instance lacked proper synchronization, leading to potential data corruption under heavy concurrent API requests.
Authentication Bypass: The JWT generation used predictable millisecond-based timestamps for the nonce payload. This allowed attackers to predict nonces and perform replay attacks. The fix enforces random UUID-based nonces.