Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kong/unirest-java
main @ 3d30ce8
3
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
AuthUtil.java: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
TLS/SSL Verification Bypass: A noop hostname verifier was silently used, disabling hostname validation on the TLS connection; this is a classic high-impact transport security failure.
Auth Bypass: The Authorization header was built without the required 'Basic ' scheme prefix, causing the server to reject or misinterpret credentials and effectively bypassing authentication.
Information Disclosure: Missing null checks on publicKey/privateKey could lead to malformed or empty auth headers, potentially disclosing request context or causing unintended behavior.