Vulnerability · Published Sep 11, 2026 · Assigned by GitHub_M
CVE-2026-54072Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
Critical 9.3
In plain English
A critical-severity open redirect in authorizer from authorizerdev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/authorizerdev/authorizer | 0.0.0-20260409051328-bd3f5baf6d3d | GHSA-h29v-hj44-q8cv |
| Go | github.com/authorizerdev/authorizer | 0.0.0-20260409051328-bd3f5baf6d3d | GO-2026-5959 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| authorizerdev | authorizer | < 2.2.1 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N