authorizer vulnerabilities
CVEs whose affected-version data names the authorizer package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-103752Critical· 9.8PoCUnauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
▾ AbyssalPaul Ryan · authorizerEPSS 0.32%via NVD
CVE-2026-54072Critical· 9.3PoCAuthorizer is an open-source, self-hostable authentication and authorization server
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` …
▾ Abyssalauthorizerdev · authorizerEPSS 0.46%via NVD