authorizerdev github.com/authorizerdev/authorizer vulnerabilities

Latest authorizerdev github.com/authorizerdev/authorizer CVEs

Newest publication first

1. CVE-2026-123196 Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata

   Published 2026-11-05

   High·CVSS 8.6 EPSS 0.36%

   Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header...

2. CVE-2026-54072 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

   Published 2026-09-11

   Critical·CVSS 9.3

   Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. When response_type=token or response_type=id_token, the server appends acces...

3. CVE-2026-35511 Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

   Published 2026-08-18

   High·CVSS 8.7

   The OAuth callback handler links incoming OAuth identities (Google, GitHub, etc.) to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address (wit...

4. GHSA-x3f4-v83f-7wp2 Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

   Published 2026-04-06

   High·CVSS 8.6

   Hi, I found that 6 endpoints in Authorizer accept a user-controlled redirect_uri and append sensitive tokens to it without validating the URL against AllowedOrigins. The OAuth /app handler validates redirect_uri at http_handlers/app.go:46, but the GraphQL mutations and verify_ema...

5. GHSA-jfwg-rxf3-p7r9 Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

   Published 2026-04-06

   High·CVSS 7.3

   Vulnerability Details CWE: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic All 66+ CQL queries in internal/storage/db/cassandradb/ use fmt.Sprintf to interpolate user-controlled values directly into CQL query strings without parameterization. Unauthentic...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.