Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

safe-global/safe-client-gateway

              main @ 56c05cd
            

Fixes

CVEs

CRITICAL

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 27 prior fixes. Scrutinize any change in this area.

src/modules/auth/oidc/routes/oidc-auth.service.ts: most-fixed (3 issues). Treat as high-risk during review.

40 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes target the same authentication surface: step-up elevation session expiry, unverified email acceptance, nonce entropy, and token verification via JWKS. A bypass here compromises the entire platform's identity layer.

Signature Verification Bypass: Multiple fixes address incomplete signature parsing, missing hash verification, and failure to check all recovered addresses against owners/delegates. A bypass here allows unauthorized transaction proposals or message signing.

Auth Bypass: Fixes enforce ACTIVE membership status, switch attribution to user IDs, and prevent data leakage. The risk is that sibling endpoints or sub-loaders may not enforce the same membership checks.