Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spring-projects/spring-security-oauth

              main @ 0344de8
            

Fixes

CVEs

CRITICAL

Peak severity

31.8%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

spring-security-oauth2: most-fixed (12 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Expression Language Injection: The rendering of approval and error endpoints using Spring Expression Language (SpEL) templates allowed attackers to execute arbitrary code via SpelExpressionParser. Subsequent fixes removed SpelView in favor of HTML-escaping.

Deserialization of Untrusted Data: Unconstrained Java deserialization via ObjectInputStream in token stores (JDBC and Redis backends) allowed arbitrary remote code execution. Mitigation required enforcing class allowlists using custom input streams.

Open Redirect: Weaknesses in default redirection URI matching (such as subdomain wildcard matching and missing path canonicalization) could leak sensitive authorization codes to arbitrary external hosts.