GHSA-jfwg-rxf3-p7r9 Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

Q: Which versions are affected by GHSA-jfwg-rxf3-p7r9?

3 open source packages ship an affected version, including github.com/authorizerdev/authorizer.

Q: Is GHSA-jfwg-rxf3-p7r9 being exploited?

There is no known exploitation of GHSA-jfwg-rxf3-p7r9 in the wild and no public exploit code.

Q: How do I fix GHSA-jfwg-rxf3-p7r9?

Upgrade github.com/authorizerdev/authorizer to 0.0.0-20260327055742-73679faa53cd or later.

Not scored Published 6 Apr 2026

Unauthenticated attackers can inject CQL queries via public endpoints to bypass authentication or extract data in Authorizer with Cassandra backend.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-jfwg-rxf3-p7r9?

GHSA-jfwg-rxf3-p7r9 is a SQL injection vulnerability in github.com/authorizerdev/authorizer, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability Details

CWE: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

All 66+ CQL queries in internal/storage/db/cassandradb/ use fmt.Sprintf to interpolate user-controlled values directly into CQL query strings without parameterization.

Unauthenticated endpoints (signup, login, forgot_password, magic_link_login) pass user input directly into CQL query strings.

Note: This advisory covers the Cassandra CQL injection only. The Couchbase N1QL injection is tracked in a separate advisory per CVE rule 4.2.11.

Affected Code Pattern

// Before (VULNERABLE) - e.g. cassandradb/user.go
query := fmt.Sprintf(&#34;SELECT ... FROM %s WHERE email = &#39;%s&#39;&#34;, table, email)
err := p.db.Query(query).Scan(...)

Steps to Reproduce

Deploy Authorizer <= 2.0.0 with Cassandra backend
Send a signup request with a CQL injection payload in the email field:

curl -X POST http://localhost:8080/graphql \
  -H &#39;Content-Type: application/json&#39; \
  -d &#39;{&#34;query&#34;:&#34;mutation { signup(params: { email: \&#34;test&#39;\&#34; }) { message } }&#34;}&#39;

The single quote breaks out of the CQL string literal, causing a CQL parse error that leaks internal schema information
Crafted payloads can manipulate query logic to bypass authentication or extract data

Affected Files (10 Cassandra files)

Package	File	Queries Fixed
cassandradb	user.go	7
cassandradb	otp.go	4
cassandradb	session_token.go	19
cassandradb	verification_requests.go	4
cassandradb	authenticator.go	3
cassandradb	email_template.go	5
cassandradb	webhook.go	5
cassandradb	webhook_log.go	2
cassandradb	session.go	1
cassandradb	env.go	2

Impact

An unauthenticated attacker can inject arbitrary CQL operators through the email, phone, or token parameters on public-facing endpoints (signup, login, forgot_password, magic_link_login). This enables authentication bypass and data exfiltration from the Cassandra keyspace.

Proposed Fix

Use parameterized queries:

// After (FIXED)
query := fmt.Sprintf(&#34;SELECT ... FROM %s WHERE email = ?&#34;, table)
err := p.db.Query(query, email).Scan(...)

Fixed in https://github.com/authorizerdev/authorizer/pull/500 (merged 2026-03-27).

Which versions are affected by GHSA-jfwg-rxf3-p7r9?