Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
necaris/python3-openid
main @ fbc7f6a
24
Fixes
0
CVEs
CRITICAL
Peak severity
95.5%
Coverage
Highlights
Auth Bypass: 15 prior fixes. Scrutinize any change in this area.
openid/consumer/consumer.py: most-fixed (11 issues). Treat as high-risk during review.
21 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes target discovery verification logic, where mismatched or malformed identifiers (fragments, case, local_id, claimed_id) can be accepted, leading to authentication bypass.
Auth Bypass: Realm verification was historically incomplete or incorrect, allowing unauthorized return_to URLs and domain manipulation via wildcards.
Signature Bypass: Signature generation and verification had multiple flaws: incorrect mode, unsorted fields, and replay of check_auth, enabling forged or replayed responses.