CVE-2026-54072 Details
Description
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.
A vulnerability exists in Authorizer versions prior to 2.2.1, specifically within the OAuth2 authorization endpoint. The issue arises because the endpoint fails to validate the 'redirect_uri' parameter against the 'AllowedOrigins' configuration. As a result, when 'response_type' is set to 'token' or 'id_token', the server redirects to the attacker-supplied URL, appending sensitive tokens such as 'access_token', 'id_token', and 'refresh_token' as query parameters. This flaw allows an unauthenticated attacker to steal tokens by crafting a malicious URL and tricking a logged-in user into clicking it. The required 'client_id' can be obtained from a public GraphQL endpoint without authentication.
Users can update to Authorizer version 2.2.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Authorizer | < 2.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |