Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lepture/flask-oauthlib
master @ 260a1d5
24
Fixes
0
CVEs
CRITICAL
Peak severity
45.5%
Coverage
Highlights
Auth Bypass: 20 prior fixes. Scrutinize any change in this area.
flask_oauthlib/provider/oauth2.py: most-fixed (13 issues). Treat as high-risk during review.
19 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The validator completely skipped client secret verification during client authentication, allowing unauthorized clients to obtain access tokens. Additionally, multiple authentication bypasses involved relying on cached objects or omitting checks for confidential clients.
Auth Bypass: Missing verifier validation, unverified request token ownership, and flawed validation of missing or empty access tokens allowed unauthorized API access in the OAuth1 provider stack.
Auth Bypass: Token revocation logic failed to verify that the requestor owned the token being deleted, potentially allowing malicious actors to revoke arbitrary tokens.