Security vulnerabilities and automated fixes for spring security issues
2 posts found
A critical authentication bypass was discovered in `JwtExtractor.java` where `JWT.decode()` was used instead of a proper signature-verifying method, allowing any attacker to forge a JWT with an arbitrary username — including `admin` — and gain unauthorized access. The fix adds clear documentation establishing the trust boundary: signature validation must occur upstream, and the extracted claims are for display purposes only. This change prevents the class from being misused as an authorization g
A high-severity security flaw in Halo's `PersistentTokenBasedRememberMeServices` allowed stolen remember-me tokens to remain permanently valid — even after expiration was detected. The vulnerable implementation explicitly documented that expired tokens would *not* be removed from storage, meaning an attacker who stole a cookie could retain access indefinitely. The fix ensures expired tokens are immediately deleted from storage the moment they are detected, closing a persistent backdoor.