Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
panva/node-oidc-provider
main @ 987bb58
97
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 58 prior fixes. Scrutinize any change in this area.
lib/actions/authorization/process_request_object.js: most-fixed (7 issues). Treat as high-risk during review.
44 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The request object decoding and parsing phase is highly susceptible to signature validation bypasses, parameter injection, and mismatch issues where decrypted contents are not properly validated or marked as signed prematurely.
SSRF: Resolving client-controlled request URIs during registration or OIDC requests can result in server-side request forgery (SSRF) targeting internal resources or private IP addresses unless blocked at the network agent/dispatcher layer.
Auth Bypass: Failure to accurately preserve decrypted request object payloads in the context body can lead downstream validation routines to evaluate unverified parameters instead of the true decrypted statements.