Authorizerdev vulnerabilities
We track 2 vulnerabilities in Authorizerdev products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Authorizerdev vulnerabilities
- 8.1 High severity
authorizer: Weak Password Recovery Mechanism for Forgotten Password
Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Au
- 9.3 Critical severity
authorizer: URL Redirection to Untrusted Site
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_to