# CVE-Derived Negative-Path Test Audit

| Field | Value |
|---|---|
| Date | 2026-04-23 (PR #252, commit 31b5b01) |
| Auditor | Claude Opus 4.6 (Claude Code), directed by eugenioenko |
| Commit audited | parent of 31b5b01 |
| Scope | 45 tests across 8 attack patterns, derived from public CVEs in Keycloak, Auth0, Authentik, ORY Fosite/Hydra, and mod_auth_openidc, plus RFC 6819/9700 attack guidance |

## Result

✅ **All 45 tests passed with no application code changes needed** — the implementation
was already resistant to every CVE-derived attack vector tested. The tests remain in
`tests/security/` as a permanent regression suite.

## Coverage

| Attack class | Tests | Key CVEs |
|---|---|---|
| Redirect URI bypass | 10 | CVE-2023-6291, CVE-2024-1132, CVE-2024-8883, CVE-2020-15234, CVE-2024-52289 |
| Auth code replay | 5 | CVE-2026-4282, RFC 6749 §10.5/§10.6 |
| PKCE downgrade | 6 | CVE-2024-23647, RFC 7636, RFC 9700 §2.1.1 |
| JWT algorithm confusion | 7 | CVE-2022-23539/40/41, CVE-2026-23552 |
| Refresh token rotation abuse | 6 | CVE-2026-1035, RFC 6749 §6/§10.4 |
| Session fixation / security | 5 | CVE-2020-10734, CVE-2017-12159, CVE-2024-7341 |
| SSRF in federation | 3 | CVE-2020-10770, CVE-2026-1180 |
| Token lifecycle validation | 5 | CVE-2025-64521, CVE-2021-32701 |

Full CVE-to-test mapping: [`tests/security/CVE_REFERENCE.md`](../tests/security/CVE_REFERENCE.md)

## Follow-ups in the same vein

- PR #271 — adversarial security tests for listquery endpoints (`security_listquery_test.go`)
- PR #272 — OAuth2 and account API security tests, removal of theater tests
- PR #285 — reduced oversized strings in adversarial tests