Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

IrosTheBeggar/mStream

              master @ cc02254
            

Fixes

CVEs

CRITICAL

Peak severity

51.4%

Coverage

Highlights

Auth Bypass: 17 prior fixes. Scrutinize any change in this area.

src/api/auth.js: most-fixed (6 issues). Treat as high-risk during review.

53 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple distinct bypasses in the no-users/public-mode auto-auth branch, each granting full access or admin privileges to unauthenticated requests.

Path Traversal: Torrent subpath validation was hardened against Windows path traversal and symlink-following cleanup, with multiple related fixes.

Stored XSS: Repeated stored XSS via iziToast and innerHTML rendering of attacker-controlled data (library names, torrent names, lyrics, usernames) across multiple webapp views.