{"id":"CVE-2026-54072","title":"Authorizer is an open-source, self-hostable authentication and authorization server","summary":"Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` …","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":["CWE-601"],"vendor":"authorizerdev","product":"authorizer","affected":["authorizer < 2.2.1"],"patched":["github.com/authorizerdev/authorizer 0.0.0-20260409051328-bd3f5baf6d3d"],"published":"2026-09-11","updated":"2026-09-15","sourceUpdated":"2026-09-15T17:17:19.290","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54072","references":[{"url":"https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv","label":"security-advisories@github.com"},{"url":"https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-h29v-hj44-q8cv"}],"tags":["nvd","cve.org","exploit-available","ghsa","go"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-15T16:29:02.951552Z"},"epss":0.00272,"epssPercentile":0.19822,"aliases":["GHSA-h29v-hj44-q8cv"],"ecosystem":"go","ingestedAt":"2026-07-10T20:06:10.893Z","slug":"CVE-2026-54072","body":"## Overview\n\nAuthorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54072)\n\nAffected packages:\n\n- `github.com/authorizerdev/authorizer < 0.0.0-20260409051328-bd3f5baf6d3d`\n\nPatched in:\n\n- `github.com/authorizerdev/authorizer 0.0.0-20260409051328-bd3f5baf6d3d`\n\nSource: https://github.com/advisories/GHSA-h29v-hj44-q8cv","depth":"abyssal","depthScore":63,"depthScoreParts":{"impact":51.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":204309,"id":"CVE-2026-54072","ts":1789494096633,"field":"exploit_available","old":"false","new":"true"}]}