Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
spring-projects/spring-session
main @ 183816e
18
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 10 prior fixes. Scrutinize any change in this area.
spring-session-core: most-fixed (4 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Session filtering logic is easily bypassed during container-specific internal error dispatches if filters are prematurely marked as already-filtered. This allows unauthenticated requests or stale context to bypass spring-session's wrapper filters on error forwards.
Session Fixation: Failures in propagating session ID rotations (such as when calling changeSessionId) to underlying repositories, wrapping classes, and outbound cookie strategies leave users vulnerable to session fixation because the original identifier remains active or trusted.
Auth Bypass: Inconsistent read-time validation of session expiration across repository backends (e.g., Redis, MongoDB, and memory Maps) can result in expired sessions being handed back to the framework as valid active sessions.