Open redirect via unvalidated redirect_uri in Authorizer /authorize endpoint
Authorizer before 2.2.1 skips redirect_uri allowlist validation, enabling OAuth authorization-code theft via crafted redirect URLs. CVSS 9.3 critical.
- Vendor
- authorizerdev
- Product
- Authorizer (all versions prior to 2.2.1)
- CVSS
- 9.3
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-54072 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-54072 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-54072 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-54072 is an open-redirect vulnerability in Authorizer, the open-source self-hosted authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepted any value supplied in the redirect_uri parameter without validating it against the set of URIs registered for the requesting OAuth client.
RFC 6749 (Section 4.1.2.1) requires authorization servers to reject authorization requests where the supplied redirect_uri does not exactly match a pre-registered value. Authorizer did not perform this check. An unauthenticated attacker who could direct a user to a crafted authorization URL could have the resulting authorization code or token delivered to an attacker-controlled server instead of the legitimate application.
Fix: Upgrade to Authorizer 2.2.1 or later. The GitHub security advisory (GHSA-h29v-hj44-q8cv) documents the fix. No workaround is available for the affected endpoint short of restricting access to the /authorize path via a network control or reverse-proxy rule that validates the redirect_uri independently.
