Is CVE-2026-54072 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54072 being exploited in the wild.

How severe is CVE-2026-54072?

Critical severity, with a CVSS score of 9.3, published 11 September 2026.

Which products and versions are affected?

Authorizer < 0.0.0-20260409051328-bd3f5baf6d3d; github.com/authorizerdev/authorizer (Go) < 0.0.0-20260409051328-bd3f5baf6d3d, SEMVER:introduced=0,fixed=0.0.0-20260409051328-bd3f5baf6d3d.

Is there a fix for CVE-2026-54072?

Yes. github.com/authorizerdev/authorizer (Go): upgrade to 0.0.0-20260409051328-bd3f5baf6d3d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54072 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54072?

Check whether you run Authorizer or github.com/authorizerdev/authorizer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54072: Authorizer unvalidated redirect_uri in /authorize leaks OAuth2 tokens

Q: Which products and versions are affected?

Authorizer < 0.0.0-20260409051328-bd3f5baf6d3d; github.com/authorizerdev/authorizer (Go) < 0.0.0-20260409051328-bd3f5baf6d3d, SEMVER:introduced=0,fixed=0.0.0-20260409051328-bd3f5baf6d3d.

Q: Is there a fix for CVE-2026-54072?

Yes. github.com/authorizerdev/authorizer (Go): upgrade to 0.0.0-20260409051328-bd3f5baf6d3d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54072 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54072?

Check whether you run Authorizer or github.com/authorizerdev/authorizer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54072 · Severity: critical · CVSS 9.3 · Published 2026-09-11

Authorizer, an open-source authentication and authorization solution, contains a security flaw in its login process. An attacker can trick a logged-in user into clicking a malicious link, which causes the system to send the user's private security tokens (access, ID, and refresh tokens) directly to the attacker's server. This allows the attacker to completely impersonate the victim and access their account data without needing their password.

Technologies: github.com/authorizerdev/authorizer (Go). Vendors: Go.

Quick answers

Is CVE-2026-54072 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54072 being exploited in the wild.
How severe is CVE-2026-54072?: Critical severity, with a CVSS score of 9.3, published 11 September 2026.
Which products and versions are affected?: Authorizer < 0.0.0-20260409051328-bd3f5baf6d3d; github.com/authorizerdev/authorizer (Go) < 0.0.0-20260409051328-bd3f5baf6d3d, SEMVER:introduced=0,fixed=0.0.0-20260409051328-bd3f5baf6d3d.
Is there a fix for CVE-2026-54072?: Yes. github.com/authorizerdev/authorizer (Go): upgrade to 0.0.0-20260409051328-bd3f5baf6d3d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54072 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54072?: Check whether you run Authorizer or github.com/authorizerdev/authorizer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/authorizerdev/authorizer (Go): upgrade to 0.0.0-20260409051328-bd3f5baf6d3d or later
```
go get github.com/authorizerdev/authorizer@v0.0.0-20260409051328-bd3f5baf6d3d
```

Technical details

An open redirect vulnerability (CWE-601) exists in the `/authorize` endpoint of Authorizer due to missing validation of the `redirect_uri` parameter against the `AllowedOrigins` configuration. When a request uses `response_type=token` or `response_type=id_token`, the application appends sensitive OAuth2 tokens (access_token, id_token, and refresh_token) as query parameters to the user-supplied redirect URL. An unauthenticated attacker can retrieve the necessary `client_id` from the public `/graphql` endpoint and craft a malicious link. If a logged-in victim clicks this link, their browser automatically follows a 302 redirect, delivering the tokens to the attacker's infrastructure. A fix was implemented in version 0.0.0-20260409051328-bd3f5baf6d3d by adding `IsValidOrigin` checks to the affected handler.

Affected products

authorizerdev Authorizer < 0.0.0-20260409051328-bd3f5baf6d3d

Identifiers

CVE-2026-54072
GHSA-h29v-hj44-q8cv
GO-2026-5959

Timeline

2026-06-03: disclosed: Vulnerability reported by morimori-dev
2026-07-10: advisory: GitHub Advisory published
2026-04-09: patched: Patch version released based on version string date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.