{"repo":"NousResearch/hermes-agent","public_id":"10693","display_label":"OAuth PKCE state and code_verifier conflation security fix","summary":"These members concern a security vulnerability where the OAuth PKCE code_verifier was incorrectly reused as the state parameter, leaking it via the authorization URL. The group includes the bug report, fixes separating the two values, and related cleanup of an unused PKCE flow.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":26861,"merged_at":"2026-05-16T09:38:03+00:00"},"resolution":{"state":"resolved","by":"pr-26861"},"freshness":{"state":"verified","last_verified_at":"2026-05-16T09:38:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":10693,"pr_number":26861,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-05-16T09:38:03+00:00"}],"members":[{"kind":"issue","number":10693,"title":"OAuth PKCE code_verifier reused as state parameter — verifier leaked via authorization URL","url":null,"state":"closed"},{"kind":"pr","number":10699,"title":"fix(security): separate OAuth PKCE state from code_verifier","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#26861","number":26861},{"kind":"pr","value":"#1775","number":1775},{"kind":"pr","value":"#2647","number":2647},{"kind":"pr","value":"#3107","number":3107},{"kind":"pr","value":"#10699","number":10699}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":26861,"title":"fix(security): separate OAuth PKCE state from code_verifier (#10693)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/anthropic_adapter.py","scripts/release.py","tests/agent/test_anthropic_oauth_pkce.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}