authorizerdev

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

authorizerdev records in CISA KEV

No authorizerdev vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-39003 CVE-2026-54072 · GHSA-h29v-hj44-q8cv

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

HIGH 75

Authorizer is an open-source, self-hostable authentication and authorization server.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00463 Published 2026-09-11 Fixed in 2.2.1, 0.0.0-20260409051328-bd3f5baf6d3d CWE-601

TI-2026-85575 CVE-2026-123196 · GHSA-4q96-hqv8-w3gh

Authorizer Password Reset Poisoning via x-authorizer-url gRPC Metadata

LOW 37

Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00356 Published 2026-11-05 Fixed in 2.4.2 CWE-640

Open these records in search →

Critical	1
High	1
Medium	0
Low	0
No CVSS	0