Skip to content

Fix remember-me token signature forgery and expected signature leak#3

Draft
Copilot wants to merge 3 commits intomasterfrom
copilot/fix-authentication-bypass-vulnerability-another-one
Draft

Fix remember-me token signature forgery and expected signature leak#3
Copilot wants to merge 3 commits intomasterfrom
copilot/fix-authentication-bypass-vulnerability-another-one

Conversation

Copy link
Copy Markdown

Copilot AI commented Feb 18, 2026 •
edited
Loading

Two auth bypass vulnerabilities in TokenBasedRememberMeServices2: the token signature could be forged using a known constant, and the valid signature was leaked in error messages.

Predictable token signature bypass

makeTokenSignature() returned the literal string "no-prop" when UserSeedProperty was null, completely bypassing HMAC computation. An attacker could forge a remember-me cookie for any affected user:

Base64("admin:" + expiryTime + ":no-prop")  →  authenticated as admin

Fix: Use "no-prop" as a seed input to the HMAC rather than returning it directly, so the signature always depends on server-side secrets.

// Before
if (userSeedProperty == null) {
    return "no-prop";
}
userSeed = userSeedProperty.getSeed();

// After
if (userSeedProperty == null) {
    userSeed = "no-prop";
} else {
    userSeed = userSeedProperty.getSeed();
}
// HMAC always computed below

Expected signature disclosure in error message

processAutoLoginCookie() included the server-computed HMAC in the InvalidCookieException message — the exact value needed to forge a valid cookie. Replaced with a generic message.

// Before
throw new InvalidCookieException("Cookie token[2] contained signature '" + cookieTokens[2]
        + "' but expected '" + expectedTokenSignature + "'");

// After
throw new InvalidCookieException("Cookie token[2] contained an invalid signature");

Tests

  • forgedRememberMeCookie_withNoPropSignature_shouldBeRejected — verifies "no-prop" forgery is rejected
  • makeTokenSignature_shouldAlwaysComputeHMAC — verifies signature is never the literal constant

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • repo.jenkins-ci.org
    • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -Xmx1400m -classpath /usr/share/apache-maven-3.9.12/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.12/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.12 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.12/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/jenkins/jenkins org.codehaus.plexus.classworlds.launcher.Launcher test -pl test -Dtest=hudson.security.TokenBasedRememberMeServices2Test -Dsurefire.useFile=false -Dmaven.test.redirectTestOutputToFile=false (dns block)
  • www.jenkins.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Copilot AI and others added 2 commits February 18, 2026 13:43
@DominicBreuker
Fix critical authentication bypass in remember-me token signature and…
de3d967 
… remove signature leak from error messages

Two security fixes in TokenBasedRememberMeServices2:

1. makeTokenSignature() no longer returns the literal string "no-prop" when
   UserSeedProperty is null. Instead, "no-prop" is used as a seed value and
   the HMAC is still computed, making the signature unpredictable without
   knowledge of the server-side secret keys.

2. processAutoLoginCookie() no longer includes the expected valid HMAC signature
   in the InvalidCookieException error message. The old message leaked the exact
   server-computed signature that an attacker would need to forge a valid
   remember-me cookie for any user.

Co-authored-by: DominicBreuker <[email protected]>
@DominicBreuker
Add tests for remember-me token forgery protection and signature leak…
0c16d81 
… fix

Co-authored-by: DominicBreuker <[email protected]>
Copilot AI changed the title [WIP] Fix critical authentication bypass vulnerability in code base Fix remember-me token signature forgery and expected signature leak Feb 18, 2026
Copilot AI requested a review from DominicBreuker February 18, 2026 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DominicBreuker DominicBreuker Awaiting requested review from DominicBreuker

Assignees

@DominicBreuker DominicBreuker

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@DominicBreuker