Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zlt2000/microservices-platform

              master @ d53d7b0
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

zlt-uaa: most-fixed (5 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Incomplete tenant context validation and lack of context cleanup can allow tenant IDs to leak across execution threads, leading to severe cross-tenant data access bypasses.

Deserialization of Untrusted Data: Using standard Java native serialization on Redis backends opens up the platform to remote code execution (RCE) via untrusted serialized payloads.

Auth Bypass: Using 'get' instead of 'delete' for client details cache eviction fails to invalidate active sessions, leaving revoked or modified clients authorized.