Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

idurar/idurar-erp-crm

              master @ e935dec
            

Fixes

CVEs

HIGH

Peak severity

77.8%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

controllers/coreControllers/authJwtController/login.js: most-fixed (2 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address incomplete role checks and missing authentication on routes, indicating a systemic weakness in access control.

NoSQL Injection: Login endpoints lacked input validation, allowing injection via email field; similar patterns may exist in other query endpoints.

Information Disclosure: Sensitive fields like loggedSessions and password hashes were exposed in API responses, risking session hijacking and credential leakage.