What’s Vulnerable › Vulnerabilities

CVE-2026-54072: Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

• Severity: critical (CVSS 9.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-11 · updated 2026-09-30
• Weakness: CWE-601

Description

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.

Affected products

• authorizerdev authorizer: before 2.2.1

References

• https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv
• https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv

Get alerted when CVE-2026-54072 or the next vulnerability affects your stack