Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Kavizangi/hollaex-kit

              master @ a65abc8
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Auth Bypass: 22 prior fixes. Scrutinize any change in this area.

tools/security.js: most-fixed (6 issues). Treat as high-risk during review.

24 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address token verification bypasses: invalid API keys, empty scopes, missing auth headers, and missing user deactivation checks. These are core authorization gates that can be bypassed individually or in combination.

Auth Bypass: HMAC signature verification was bypassed because the API key equality check was missing before signature validation. Also, missing auth header handling and captcha config null checks could lead to unauthorized access.

Auth Bypass: Password change and token update/delete flows lacked OTP or email verification, allowing unauthorized modifications. Login also lacked email verification check.