Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
songquanpeng/one-api
main @ 8df4a26
16
Fixes
0
CVEs
HIGH
Peak severity
37.5%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
middleware/auth.go: most-fixed (4 issues). Treat as high-risk during review.
9 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Insecure prefix matching logic on `/models` allowed attackers to evade token consumption and quota deduction, bypassing critical business validation pathways.
Race Condition: Concurrency bugs permitted balance and quota bypasses due to the absence of pessimistic database locking during user and token quota updates.
Broken Access Control: Standard users were able to manually override load-balancing mechanisms and access restricted channels by specifying arbitrary channel IDs without administrative validation.