Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

passbolt/passbolt_api

              master @ 31c1bbc
            

265

Fixes

CVEs

CRITICAL

Peak severity

45.7%

Coverage

Highlights

Auth Bypass: 83 prior fixes. Scrutinize any change in this area.

cake/libs/controller/components/auth.php: most-fixed (19 issues). Treat as high-risk during review.

190 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple JWT-related bypasses: disabled users could authenticate, algorithm confusion allowed HS256 forgery, refresh tokens had race conditions, and authenticator was loaded on unintended endpoints.

CSRF Protection Bypass: CSRF token validation was bypassed via missing session data, array field mishandling, non-POST methods, and serialization issues; also CSRF tokens could be leaked or reused.

Reflected XSS: User-controlled data was echoed into HTML without proper encoding in error pages, email templates, MFA pages, and form helpers, enabling script injection.