Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
phoenixframework/phoenix
main @ afcac09
16
Fixes
2
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
priv/templates/phx.gen.auth/auth.ex: most-fixed (4 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Expired tokens could be erroneously treated as valid due to unit mismatches (milliseconds vs seconds) and boundary checks allowing a max_age of 0 or less to bypass expiration.
Cross-Site Request Forgery: Improper origin validation during socket transport negotiation can allow attackers to perform Cross-Site WebSocket Hijacking if check_origin or check_csrf is bypassed or misconfigured.
Auth Bypass: Generated authentication code has suffered from flawed logout flows where 'remember me' cookies failed to delete correctly, missing session scope validation checks, and lack of live_socket_id updates during session recovery.