CVE-2026-54072
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-601
Redireccionamiento de URL a sitio no confiable (Open Redirect)
Fecha de publicación:
11/09/2026
Última modificación:
30/09/2026
Descripción
*** Pendiente de traducción *** Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.
Impacto
Puntuación base 3.x
9.30
Gravedad 3.x
CRÍTICA