Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wso2/carbon-identity-framework
master @ e673888
12
Fixes
76
CVEs
CRITICAL
Peak severity
36.4%
Coverage
Highlights
Auth Bypass: 9 prior fixes. Scrutinize any change in this area.
features/api-resource-mgt: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical race conditions and cache-invalidation issues can leave stale authorizations in memory when cache eviction occurs before database writes are fully committed.
Auth Bypass: API routes can be bypassed if access control rules secure specific HTTP methods (like PUT) but fail to bind parallel modification methods (like PATCH) to the required security scopes.
Auth Bypass: Failing to separate untrusted user-supplied claims from verified system-level claims in the flow execution engine permits downstream authorization bypasses.