Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ory/kratos

              master @ 4f470ee
            

159

Fixes

CVEs

HIGH

Peak severity

28.9%

Coverage

Highlights

Auth Bypass: 71 prior fixes. Scrutinize any change in this area.

identity: most-fixed (15 issues). Treat as high-risk during review.

75 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical regressions and logic flaws in Authenticator Assurance Level (AAL) evaluation, privileged session checks, and credentials mapping allowed MFA bypasses and unauthorized trait modifications. Developers must ensure state transitions strictly enforce AAL requirements and validate credentials map integrity.

Cross-Site Request Forgery (CSRF): Browser-based self-service endpoints have historically leaked or failed to validate CSRF tokens, especially during state transitions (e.g., login, registration, recovery, and logout). Explicit token validation and proper cookie attribute inheritance are required across all browser-facing handler paths.

SSRF: Outbound requests made during OIDC authentication, schema loading, and webhook dispatching were vulnerable to SSRF via private IP ranges. Outbound HTTP clients must be explicitly configured using a centralized host blocklist to reject private or loopback ranges.