Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jitsi/jibri

              master @ c5e95a8
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

WebhookClient.kt: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Two separate fixes were needed to ensure webhook requests carry a valid JWT: one for token expiry not being re-evaluated, another for the JWT library failing to emit the Authorization header on Java 9+. Both silently degrade to unauthenticated requests.

Information Disclosure: Sensitive credentials (XMPP credentials, RTMP URL, full config) were logged via toString() and logger.info,; also the chromdriver log was written to a world-writable /tmp path. Redaction and secure log paths are required.

Path Traversal: sessionId was used unsanitized to construct a file path, allowing writes outside the intended directory. Any user-influenced string used in a filesystem path must be validated.