Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

springsource/spring-security-oauth

              main @ 0344de8
            

Fixes

CVEs

CRITICAL

Peak severity

31.8%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

spring-security-oauth2: most-fixed (12 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Expression Language Injection: A SpEL expression parsing vulnerability in endpoints like dynamic approval or error views allowed attackers to achieve Remote Code Execution (RCE) via custom payloads. Developers should avoid dynamic expression evaluation of user inputs and use manual HTML-escaping.

Deserialization of Untrusted Data: Unconstrained Java serialization across token storage backends (including Redis and JDBC stores) allowed arbitrary code execution. Robust allowlists must be enforced during deserialization operations.

Open Redirect: Flaws in DefaultRedirectResolver allowed attackers to redirect users to malicious domains, leaking authorization codes. Strict exact-path validation, path canonicalization, and disabling subdomain matching are critical safeguards.