Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
zitadel/oidc
main @ 5880b6f
33
Fixes
48
CVEs
CRITICAL
Peak severity
59.4%
Coverage
Highlights
Auth Bypass: 21 prior fixes. Scrutinize any change in this area.
pkg/op/authrequest.go: most-fixed (5 issues). Treat as high-risk during review.
23 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Incomplete validation of JWT assertions allowed attackers to bypass authentication. This was fixed by enforcing proper signature, audience, and expiration verification on JWT tokens.
Auth Bypass: PKCE downgrade attacks were possible if clients omitted the code_verifier, or if validation was skipped depending on the client authentication method. Correct implementation requires strict mandatory verification whenever a code challenge is present.
Auth Bypass: A critical logic error hardcoded the subject field ('sub') during JSON serialization/deserialization within JWT profile assertions, enabling complete user identification bypasses.