CVE-2026-54072 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
An unauthenticated attacker can leak OAuth2 tokens by exploiting an unvalidated redirect_uri in the /authorize endpoint of Authorizer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54072?
CVE-2026-54072 is a critical vulnerability in authorizerdev authorizer, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.
Weakness: CWE-601
Which versions are affected by CVE-2026-54072?
3 open source packages ship an affected version, including github.com/authorizerdev/authorizer.
| Package | Affected | Fixed in |
|---|---|---|
github.com/authorizerdev/authorizer Go | All versions | 0.0.0-20260409051328-bd3f5baf6d3d |
github.com/authorizerdev/authorizer Go | All versions | 0.0.0-20260409051328-bd3f5baf6d3d |
github.com/authorizerdev/authorizer Go | All versions | 0.0.0-20260409051328-bd3f5baf6d3d |
How do I fix CVE-2026-54072?
Upgrade github.com/authorizerdev/authorizer to 0.0.0-20260409051328-bd3f5baf6d3d or later.
Is CVE-2026-54072 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54072 exists.
Sources
Also known as GHSA-h29v-hj44-q8cv, GO-2026-5959.