Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ory/fosite

              master @ a5f0b09
            

Fixes

CVEs

HIGH

Peak severity

59.0%

Coverage

Highlights

Auth Bypass: 39 prior fixes. Scrutinize any change in this area.

handler/oauth2: most-fixed (9 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecure handling of token lifetimes, authorization code reuse, and lack of automatic session revocation upon detecting inactive refresh token reuse historically allowed session hijacking and replay attacks. Strict, atomic revocation and rotation invariants are required.

Open Redirect: Weaknesses in parsing and matching registered redirect URIs allowed bypasses through case-insensitive comparison, query-string overrides, or malformed loopback IP addresses.

Credential Replay: Failure to validate the uniqueness of JTI (JWT ID) claims in JWT-based client assertions allowed attackers to perform credential replay attacks against the token endpoint.