Executive brief
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri
Affected products
- Go github.com/authorizerdev/authorizer
Junglewise Threat Intelligence
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri
Severity: medium · CVSS 4 · Published 2026-04-06
Technologies: github.com/authorizerdev/authorizer (Go). Vendors: Go.
Related threats
- Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accep
- Authorizer OAuth account takeover via unverified email linking
- GO-2026-5737 - Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri in github.com/authorizerdev/authorizer
- GO-2026-5467 - Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation in github.com/authorizerdev/authoriz
- Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation