hyperscale-stack / security / 39660049309

98%

push

github

fix(oidc)!: close the OpenID Provider findings of the 2026-10-21 security audit

Close the OpenID Provider findings of the security audit of 2026-10-21.

- Claim names: a name tagged with a well-formed BCP 47 language tag
  (RFC 5646, strict grammar) that reads as a reserved or known claim
  (email#verified, phone_number#verified, email#verified-fr…) is never
  released, and a name whose part before `#` is a reserved or known
  claim (sub#x, Email#x) stays refused; URI names with a fragment keep
  working. New refuses such ClaimsSupported entries, checked in two
  passes so the order does not matter (F-10).
- An access-token audience naming the requesting client or a client of
  the issuer that declares authorization_code is refused, so an access
  token cannot be replayed as a relying party's token (D-10).
- Plain OAuth 2.0 grants approved through Provider.AuthorizeHandler
  record a minimal context and every exchange checks that the end-user
  is still valid (D-11).
- UserInfo answers 401, not 500, when the client store reports an
  unknown client.

Breaking changes and migration steps: MIGRATION.md.

Audit: F-10, D-10, D-11.

200 of 200 new or added lines in 9 files covered. (100.0%)

14574 of 14787 relevant lines covered (98.56%)

5363.72 hits per line