Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

parse-community/parse-dashboard

              alpha @ 137e5bd
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

Parse-Dashboard/Authentication.js: most-fixed (5 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in username-only checks during credential comparison and the historical use of a static hardcoded cookie session secret ('magic') allowed remote attackers to bypass authentication controls.

Auth Bypass: Sensitive routes like the AI Agent API endpoint lacked sufficient authentication, cross-app authorization, and remote access restrictions, leaving them exposed to unauthorized access.

Open Redirect: The login redirection mechanism was vulnerable to open redirects because it did not properly restrict target destinations to relative paths, allowing attackers to construct malicious absolute or protocol-relative URLs.