Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vimalloc/flask-jwt-extended

              main @ 8ee8fde
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

flask_jwt_extended/view_decorators.py: most-fixed (7 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The application decoded tokens without locking down the acceptable signature algorithms, allowing potential algorithm-switching attacks where signature validation could be bypassed entirely.

Auth Bypass: Lax structural verification of critical JWT claims (such as identity, type, fresh, and jti) allowed malformed tokens lacking structural integrity to be processed as valid.

CSRF: CSRF validation checks were bypassed on per-route cookie endpoints if JWT cookies were not configured globally, exposing users to cross-site request forgery.