CVE-2026-54072Critical· 9.3▾ AbyssalPoC availableAuthorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 51.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. When response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required client_id from the public /graphql?query={meta{client_id}} endpoint. A partial fix was applied in v2.0.1 to other handlers (oauth_login, verify_email, magic_link_login, forgot_password, invite_members, oauth_callback) but /authorize was not included. Version 2.2.1 contains a more complete fix.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/authorizerdev/authorizer < 0.0.0-20260409051328-bd3f5baf6d3dPatched in:
github.com/authorizerdev/authorizer 0.0.0-20260409051328-bd3f5baf6d3dField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94216Medium· 4.3A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717
CVE-2026-93871Medium· 5.4Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts
CVE-2026-93869Medium· 6.1Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor
CVE-2026-91772Medium· 6.1Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter
CVE-2026-47883Medium· 6.1UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
CVE-2026-86256Medium· 5.4wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py)