Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

logto-io/logto

              master @ 2c0fb1f
            

134

Fixes

CVEs

CRITICAL

Peak severity

27.3%

Coverage

Highlights

Auth Bypass: 75 prior fixes. Scrutinize any change in this area.

packages/core/src/routes/experience/classes/experience-interaction.ts: most-fixed (7 issues). Treat as high-risk during review.

60 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: First-time admin registration automatically assigns the Admin role. A logic flaw allowed malicious users to claim administrative control if the 'hasActiveUsers' validation was skipped or bypassed during registration.

Auth Bypass: The Koa authorization middleware historically allowed request processing without verifying the signature, issuer, or audience of incoming JSON Web Tokens (JWTs).

Auth Bypass: Flaws in Adaptive MFA and mandatory MFA checks during interaction submissions allowed authentication flows to proceed without forcing users to verify or bind required MFA factors.