Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

FusionAuth/fusionauth-jwt

              main @ 7a5ef8b
            

Fixes

CVEs

CRITICAL

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

src/main/java/io/fusionauth/jwks/JSONWebKeyParser.java: most-fixed (3 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass authentication by submitting unsigned tokens or tokens using the 'none' algorithm when a strong cryptographic verifier is expected. Developers must ensure that all decoding paths reject unsecured tokens and require signature presence validation.

Auth Bypass: Parsing JSON Web Keys (JWKs) can lead to signature validation bypass if raw coordinates are utilized to generate keys without validating them against the accompanying certificate chain ('x5c'). Imbalance between parser parameters allows arbitrary key material substitution.

Auth Bypass: Java's underlying ECDSA signature verification is susceptible to bypasses (such as CVE-2022-21449) when signatures feature all-zero 'r' or 's' values. The library requires robust manual parameter checks before delegating verification to JVM security providers.