Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

h-mdm/hmdm-server

              master @ 1304f20
            

Fixes

CVEs

CRITICAL

Peak severity

23.5%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

common/src/main/java/com/hmdm/rest/filter/AuthFilter.java: most-fixed (2 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes in AuthFilter address cookie/session tampering and privilege escalation, indicating a persistent weakness in how user identity is derived and validated.

Auth Bypass: Configuration endpoints repeatedly lacked permission checks, allowing limited users to access or modify unauthorized configurations.

Auth Bypass: Sequential configuration IDs were guessable, enabling device enrollment bypass; switched to unpredictable QR keys.