Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wstrange/googleauth

              master @ cadc5de
            

Fixes

CVEs

HIGH

Peak severity

44.4%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

GoogleAuthenticator.java: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A critical logical flaw occurred where TOTP passwords were generated using the raw username as the secret key instead of looking up the registered credential, bypassing authentication controls entirely.

Insufficient Entropy: Potential SecureRandom state exhaustion and lack of periodic reseeding could lead to predictable generated secret keys and scratch codes.

Cryptography: A hardcoded offset calculation (using index 19 instead of the dynamic final byte of the hash) compromised HMAC-SHA256 and HMAC-SHA512 validation, breaking the cryptographic security of HOTP generation.