CVE-2026-54072
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In Authorizer prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. With response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql endpoint.
Risk Assessment
An attacker can capture access, identity, and refresh tokens, leading to session and account takeover.
Recommendation
Update Authorizer to version 2.2.1 or later, which contains the complete redirect_uri validation fix.
Other vulnerabilities in Authorizer
See allOriginal NVD description (English source)
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS