Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
beste/firebase-php
8.x @ 341f85c
9
Fixes
0
CVEs
HIGH
Peak severity
87.5%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
src/Firebase/Auth/IdTokenVerifier.php: most-fixed (3 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Three separate fixes in this component address distinct bypass vectors: missing signature validation, inverted expiry check, and absent 'sub' claim. Any future change to token verification must preserve all these checks.
Auth Bypass: Two fixes here address token revocation and sensitive parameter handling. The revocation check is only applied when explicitly requested, leaving a default path that may accept revoked tokens.
Auth Bypass: Original verifyToken lacked replay protection, allowing token reuse. The fix adds a separate method, meaning callers must explicitly opt in to replay protection.