CVE-2026-123196High· 8.1▾ TwilightAuthorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.
authorizer >= 2.3.0-rc.3 < 2.4.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103752Critical· 9.8Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
CVE-2026-54072Critical· 9.3Authorizer is an open-source, self-hostable authentication and authorization server
CVE-2026-114421High· 8.3Empty initial password permits GINA account takeover
CVE-2026-119127High· 8.1ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
CVE-2026-116214Critical· 9.1MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
CVE-2026-94380High· 8.1Host Header Injection in HAVELSAN's Liman MYS