CVE-2026-54072

Name of the Vulnerable Software and Affected Versions Authorizer versions prior to 2.0.1

Description The /authorize endpoint fails to validate the redirect uri parameter against a list of allowed origins. When the response type is set to token or id token, the server appends the access token, id token, and refresh token as query parameters and performs a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can retrieve the necessary client id via the public /graphql endpoint using the query {meta{client id}}. This allows an attacker to steal sensitive tokens and impersonate a logged-in user who clicks a crafted link.

Recommendations Update to version 2.0.1 or later to ensure the redirect uri is validated using the IsValidOrigin function. As a temporary workaround, restrict access to the /authorize endpoint or monitor for unusual redirect uri values that do not match known allowed origins.