Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
matomo-org/matomo
5.x-dev @ 3273a76
253
Fixes
23
CVEs
CRITICAL
Peak severity
25.0%
Coverage
Highlights
Auth Bypass: 69 prior fixes. Scrutinize any change in this area.
plugins/Login/Controller.php: most-fixed (14 issues). Treat as high-risk during review.
73 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Session tokens and credential comparisons suffered from loose type checking (null or falsey comparisons) and missing validation of user session matches during transitions like 2FA or password resets. This allowed malicious actors to authenticate or hijack sessions without full verification.
Deserialization of Untrusted Data: Matomo used standard PHP unserialize on cookie and session structures. Attackers could exploit this via PHP Object Injection to trigger arbitrary code execution, requiring transition to secure wrappers or JSON encoding.
Open Redirect: Unsanitized redirect targets and loose URL parsing validations permitted open redirection, enabling attackers to execute phishing campaigns or parameter injection against browsers.