Add 24 advisories: auth-framework (18), role-system (4), commy (2), one commit each

[ciresnave-bot]

Affected crate(s)

• auth-framework (about 2,000 recent downloads per crates.io): 18 advisories
• role-system (about 4,300 recent downloads per crates.io): 2 advisories

Links to upstream issue(s) or PR(s)

I am the maintainer of both crates (CireSnave, https://github.com/ciresnave). Each advisory is already published as a GitHub security advisory upstream, and the fix is released to crates.io (the older ones are a backfill of earlier fixed defects):

• https://github.com/ciresnave/auth-framework/security/advisories (GHSA-jr9j-g3xj-q9x8, GHSA-r75x-xf92-4hxg, GHSA-9r7g-3hh2-8x65, GHSA-7jcf-r8rm-w7vc, GHSA-rjj3-4w57-5pp8, GHSA-m3wj-w27m-8w2r, GHSA-rgmp-44q2-h34h, GHSA-h76h-g3rg-h793, GHSA-vr8g-rx9x-cfjv, GHSA-75q3-277x-h78m, GHSA-qhfj-mx85-v274, GHSA-6w98-f6q9-928f, GHSA-792m-wgrm-fjp3, GHSA-f9ph-whgh-35p4, GHSA-rf2h-7m78-hhjm, GHSA-jfmh-j245-wpjg, GHSA-cc4x-p872-64jg, GHSA-cw9x-gg6m-9cqr)
• https://github.com/ciresnave/role-system/security/advisories (GHSA-9mh5-76vx-rx5g, GHSA-c73f-r29h-fc3w)

Severity

Authorization and authentication flaws: fixed signing keys that let anyone forge tokens or introspection responses (auth-framework), MFA and OAuth2 bypasses, a predictable fallback TOTP secret, and in role-system a permission cache that answers one resource type from another's decision and instance-scoped permissions that grant every instance. Details and per-version ranges are in each advisory.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID (.N suffixes so the files coexist, as suggested)
• date field is set to the public disclosure date (the GHSA publication date)
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (I am the maintainer)

patched/unaffected were checked against every published version of each crate (0 mismatches against the GHSA ranges); the files parse with rustsec 0.33 and lint with rustsec-admin 0.8.9.

🤖 Generated with Claude Code

[djc]

Use the pull request template, and make one PR with a commit per advisory.

[ciresnave-bot]

Thanks, and sorry about the first version. This is now one PR with one commit per advisory, using the template.

A question about volume: I have 18 further advisories for auth-framework (earlier fixed defects) and one more for role-system, all already fixed and published. The lint requires the file to be named exactly RUSTSEC-0000-0000.md (I tried suffixed names in one PR and it rejected them), so only one advisory per crate fits in a PR. Would you prefer I open the remaining ones as follow-up PRs one at a time after this merges, or in some other layout? I will wait for your answer before sending any more.

[djc]

The name needs to start with RUSTSEC-0000-0000 but otherwise you can drop a .0 etc in there.

[ciresnave-bot]

Thanks, that worked: files are now RUSTSEC-0000-0000.N.md (one commit each, 18 for auth-framework and 2 for role-system) and the lint passes.