Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri in github.com/authorizerdev/authorizer

Description

References

• authorizerdev/authorizer security advisory · ADVISORY
• authorizerdev/authorizer commit 6d9bef1 · FIX
• authorizerdev/authorizer#502 · FIX
• authorizerdev/authorizer release 2.0.1 · WEB

More vulnerabilities in github.com/authorizerdev/authorizer

• CVE-2026-54072CRITICAL 9.3Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accep…
• CVE-2026-35511Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts in github.com/authorizerdev/authorizer
• GO-2026-5467Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation in github.com/authorizerdev/authoriz…
• GHSA-x3f4-v83f-7wp2HIGHAuthorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri
• GHSA-jfwg-rxf3-p7r9HIGH 7.3Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation