Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

azukaar/Cosmos-Server

              master @ e58e28c
            

Fixes

CVEs

HIGH

Peak severity

64.3%

Coverage

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

src/proxy/shield.go: most-fixed (4 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple bypasses in generated proxy routes: missing return after auth failure, missing Constellation restriction middleware, and route-specific token verification not enforced. These are high-value targets as they gate all proxied traffic.

Auth Bypass: OIDC/OAuth2 state segregation and route registration issues allow cross-route and tunneled-route bypasses. The authorization server's route registry must be kept in sync with all proxied and Constellation routes.

Auth Bypass: Device config sync (WebhookSync) and client config endpoints lacked IP/token validation, allowing unauthorized config pushes and service restarts. Network-level checks are critical for this internal API.