CVE-2026-54072

CVE-2026-54072 is an open redirect (CWE-601) in Authorizer, an open-source, self-hostable authentication and authorization server, where the /authorize endpoint accepts any redirect_uri without validating it against the configured AllowedOrigins. An unauthenticated attacker can fetch a valid client_id from the public /graphql?query={meta{client_id}} endpoint, then call /authorize with response_type=token or id_token and an attacker-controlled redirect_uri; the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect, delivering the tokens to the attacker's URL. Stolen tokens can allow account or session hijacking, and the 9.3 CVSS v3.1 score reflects network attack vector, no privileges, a scope change, and high confidentiality and integrity impact. Any deployment running Authorizer before 2.2.1 is affected; the partial fix in v2.0.1 covered other handlers (oauth_login, verify_email, magic_link_login, forgot_password, invite_members, oauth_callback) but not /authorize. No public proof of concept or confirmed exploitation (including CISA KEV listing) is currently known.

What to do: Upgrade to Authorizer 2.2.1 or later. As an interim mitigation, validate the redirect_uri parameter against your AllowedOrigins at a reverse proxy or WAF, and review logs for 302 redirects from /authorize whose redirect_uri is off-list and whose query string contains access_token, id_token, or refresh_token — treat any such tokens as leaked and rotate affected user sessions. Note that deployments on 2.0.x–2.2.0 are not fully protected, since the 2.0.1 partial fix covered other handlers but not /authorize.