Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
liferay/liferay-portal
master @ 8335c1f
15
Fixes
0
CVEs
HIGH
Peak severity
26.7%
Coverage
Highlights
Auth Bypass: 7 prior fixes. Scrutinize any change in this area.
AudiencesEntryServiceImpl.java: most-fixed (1 issue). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: OTP verification could be bypassed when the seed was stored as a key reference; the fix resolves the seed via the service, indicating a critical validation gap in the MFA flow.
Sensitive Data Exposure: MFA OTP seeds were stored in plaintext, exposing them at rest; the fix encrypts them using a key reference, addressing a high-impact credential leak.
Auth Bypass: Backchannel logout lacked audience validation and company scoping, allowing unauthorized session termination; the fix validates the token against the correct client and scope.