authorizer vulnerabilities

2 known vulnerabilities in authorizer from Authorizerdev. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  authorizer: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2026-123196Nov 5, 2026Authorizerdev

  Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Au

• 9.3 Critical severity

  authorizer: URL Redirection to Untrusted Site

  CVE-2026-54072Sep 11, 2026Authorizerdev

  Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_to