Executive brief
Authorizer, an open-source authentication and authorization solution, contains a security flaw in its login process. An attacker can trick a logged-in user into clicking a malicious link, which causes the system to send the user's private security tokens (access, ID, and refresh tokens) directly to the attacker's server. This allows the attacker to completely impersonate the victim and access their account data without needing their password.
Technical details
An open redirect vulnerability (CWE-601) exists in the `/authorize` endpoint of Authorizer due to missing validation of the `redirect_uri` parameter against the `AllowedOrigins` configuration. When a request uses `response_type=token` or `response_type=id_token`, the application appends sensitive OAuth2 tokens (access_token, id_token, and refresh_token) as query parameters to the user-supplied redirect URL. An unauthenticated attacker can retrieve the necessary `client_id` from the public `/graphql` endpoint and craft a malicious link. If a logged-in victim clicks this link, their browser automatically follows a 302 redirect, delivering the tokens to the attacker's infrastructure. A fix was implemented in version 0.0.0-20260409051328-bd3f5baf6d3d by adding `IsValidOrigin` checks to the affected handler.
Affected products
- authorizerdev Authorizer < 0.0.0-20260409051328-bd3f5baf6d3d
Timeline
- 2026-06-03: disclosed: Vulnerability reported by morimori-dev
- 2026-07-10: advisory: GitHub Advisory published
- 2026-04-09: patched: Patch version released based on version string date