Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yiisoft/yii2-authclient

              master @ e58b5e7
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

src/OpenIdConnect.php: most-fixed (6 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in OpenID Connect nonce generation, persistence, and verification across authorization and token requests allowed attackers to replay tokens and bypass authentication. Fresh nonces must be persisted in session state and strictly matched upon token exchange.

Auth Bypass: Improper handling of PKCE parameters enabled downgrade and replay attacks. The application failed to enforce the presence of a code verifier when PKCE was enabled and neglected to clear the verifier immediately after use, which is tracked as CVE-2023-50714.

Insecure Transport: The client library bypassed SSL peer validation by default ('sslVerifyPeer' => false) across HTTP requests and OAuth/OpenID clients, exposing all downstream authentication flows to Man-in-the-Middle (MitM) attacks.