---
id: CVE-2026-54072
title: >-
  Authorizer is an open-source, self-hostable authentication and authorization
  server
summary: >-
  Authorizer is an open-source, self-hostable authentication and authorization
  server. Prior to version 2.2.1, the `/authorize` endpoint accepts any
  `redirect_uri` without validating it against `AllowedOrigins`. When
  `response_type=token` …
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-601
vendor: authorizerdev
product: authorizer
affected:
  - authorizer < 2.2.1
patched:
  - github.com/authorizerdev/authorizer 0.0.0-20260409051328-bd3f5baf6d3d
published: '2026-09-11'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T17:51:56.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54072'
references:
  - url: >-
      https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv
    label: security-advisories@github.com
  - url: >-
      https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-h29v-hj44-q8cv'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - go
epss: 0.00463
epssPercentile: 0.39936
aliases:
  - GHSA-h29v-hj44-q8cv
ecosystem: go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T16:29:02.951552Z'
ingestedAt: '2026-07-10T20:06:10.893Z'
---

## Overview

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54072)

Affected packages:

- `github.com/authorizerdev/authorizer < 0.0.0-20260409051328-bd3f5baf6d3d`

Patched in:

- `github.com/authorizerdev/authorizer 0.0.0-20260409051328-bd3f5baf6d3d`

Source: https://github.com/advisories/GHSA-h29v-hj44-q8cv