Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

centrifugal/centrifugo

              master @ ec700c1
            

Fixes

CVEs

HIGH

Peak severity

84.6%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

internal/jwtverify/token_verifier_jwt.go: most-fixed (3 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address missing claim validation and algorithm confusion in JWT verification, indicating a high-risk surface for authentication bypass.

Auth Bypass: JWKS cache scoping and SSRF prevention in URL handling highlight risks of cross-tenant key confusion and server-side request forgery.

Denial of Service: Unbounded message size in stream decoder can lead to memory exhaustion; fix enforces a default limit.