Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nhost/nhost
main @ 7966a2c
141
Fixes
4
CVEs
CRITICAL
Peak severity
41.2%
Coverage
Highlights
Auth Bypass: 74 prior fixes. Scrutinize any change in this area.
src/routes/oauth/index.ts: most-fixed (8 issues). Treat as high-risk during review.
72 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Attackers can bypass authentication and hijack accounts by exploiting identity providers that return unverified emails, leading to unauthorized account merging. This risk is tracked under CVE-2026-41574.
Auth Bypass: WebAuthn sign-up flows initially trusted client-asserted user identifiers rather than performing proper challenge verification matching, allowing attackers to forge registration credentials.
Open Redirect: Validation rules for custom redirects were repeatedly bypassed due to loose regex patterns, failure to canonicalize paths, case-sensitivity issues, and weak wildcard glob-matching implementations.