Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
symfony/security-http
8.2 @ 0063980
20
Fixes
61
CVEs
CRITICAL
Peak severity
41.2%
Coverage
Highlights
Auth Bypass: 14 prior fixes. Scrutinize any change in this area.
AccessToken/Oidc/OidcTokenHandler.php: most-fixed (3 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: OidcTokenHandler historically permitted authorization bypasses by neglecting mandatory claim validations ('iat', 'exp', 'aud', 'iss') and failing to respect provider-defined expiration headers for cached keys, potentially enabling the acceptance of expired tokens or those signed by revoked keys.
Auth Bypass: The user identification logic was vulnerable to bypasses because normalized user identifiers were not re-validated for length or emptiness, and empty user identifiers initially generated deprecation warnings instead of hard authentication failures.
Auth Bypass: Form-based login flows failed to properly reject empty credentials with explicit security exceptions, risking downstream logic bypasses unless caught early and mapped directly to a BadCredentialsException or immediate bad request response.