Open redirect via unvalidated redirect_uri in Authorizer /authorize endpoint
Authorizer before 2.2.1 skips redirect_uri allowlist validation, enabling OAuth authorization-code theft via crafted redirect URLs. CVSS 9.3 critical.
- Vendor
- authorizerdev
- Product
- Authorizer (all versions prior to 2.2.1)
- CVSS
- 9.3
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
CVE-2026-54072 is an open-redirect vulnerability in Authorizer, the open-source self-hosted authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepted any value supplied in the redirect_uri parameter without validating it against the set of URIs registered for the requesting OAuth client.
RFC 6749 (Section 4.1.2.1) requires authorization servers to reject authorization requests where the supplied redirect_uri does not exactly match a pre-registered value. Authorizer did not perform this check. An unauthenticated attacker who could direct a user to a crafted authorization URL could have the resulting authorization code or token delivered to an attacker-controlled server instead of the legitimate application.
Fix: Upgrade to Authorizer 2.2.1 or later. The GitHub security advisory (GHSA-h29v-hj44-q8cv) documents the fix. No workaround is available for the affected endpoint short of restricting access to the /authorize path via a network control or reverse-proxy rule that validates the redirect_uri independently.
