CVE-2026-123196 Details
Description
Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.
A password reset poisoning vulnerability exists in Authorizer versions through 2.4.1. This vulnerability allows unauthenticated attackers to manipulate the hosts of emailed password reset or magic link URLs by sending x-authorizer-url metadata through gRPC or via the REST gateway. The vulnerability arises because the application does not properly validate or sanitize the host information in the metadata, enabling attackers to intercept reset tokens and potentially take over user accounts.
Users can upgrade to Authorizer version 2.4.2, which addresses this vulnerability by pinning the authorizer host to the --url parameter for both gRPC and REST transports, and by blocking the X-Authorizer-Url header in the gateway.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Authorizer | >= 2.3.0-rc.3, <= 2.4.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |