CVE-2026-54072: authorizerdev authorizer, пренасочване към чужд адрес

Описание

Оригинално описание

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.

Засегнати продукти

• authorizerdev authorizer: < 2.2.1

Вид слабост

• CWE-601 URL Redirection to Untrusted Site

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-54072
• https://nvd.nist.gov/vuln/detail/CVE-2026-54072
• https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv