Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

reown-com/appkit

              main @ 32af290
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

packages/adapters/solana/src/providers/AuthProvider.ts: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecure verification of signatures on smart contract wallets and social logins occurs if network-specific RPC providers are not resolved dynamically during verification, allowing authentication bypass on misconfigured nodes.

Auth Bypass: Performing case-sensitive string comparisons on cryptographic addresses during SIWX validation can result in authorization mismatches or bypasses.

Auth Bypass: Failure to clear memory-cached wallet session states upon physical provider disconnection allows unauthenticated contexts to access or interact with stale wallet keys.