Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
primocms/primo
main @ c54d3ec
15
Fixes
2
CVEs
HIGH
Peak severity
61.5%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
server/src/routes/api/_auth.js: most-fixed (2 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Asynchronous authentication callback handlers were not properly awaited, allowing standard requests to bypass route authorization checks entirely. Additionally, parsing URL parameters through manual string splitting rather than structured APIs introduced bypass opportunities.
Auth Bypass: Relying entirely on local, client-side static validity flags (isValid) for sessions without performing active back-end validation allowed authentication state bypasses. Active session verification must be performed via backend refreshes.
Privilege Escalation: Unrestricted input processing during registration allowed arbitrary role assignments, enabling registering users to self-promote to admin roles via the Supabase client without administrative validation.