Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

martialbe/one-hub

              main @ 387f8bf
            

Fixes

CVEs

HIGH

Peak severity

37.5%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

middleware/auth.go: most-fixed (4 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Banned or disabled users could bypass authentication and access APIs using active tokens due to a lack of active status validation within the session middleware. Additionally, standard users could exploit the middleware to override target channel IDs.

Insecure Defaults: The application historically permitted insecure placeholder credentials, specifically a static default SESSION_SECRET which facilitates session forgery. This is tracked publicly as CVE-2025-14651.

Cross-Site Request Forgery: OAuth callback endpoints lacked proper state parameter verification, and global CORS configurations left sensitive endpoints vulnerable to cross-site request forgery attacks.