# CVE-2026-54072

## Summary

- **CVE ID:** CVE-2026-54072
- **Severity:** CRITICAL
- **CVSS Score:** 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
- **CWE:** CWE-601
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 11, 2026

## Description

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required `client_id` from the public `/graphql?query={meta{client_id}}` endpoint. A partial fix was applied in v2.0.1 to other handlers (`oauth_login`, `verify_email`, `magic_link_login`, `forgot_password`, `invite_members`, `oauth_callback`) but `/authorize` was not included. Version 2.2.1 contains a more complete fix.

## Affected Products

- authorizerdev — authorizer (< 2.2.1)

## References

- [CNA](https://github.com/authorizerdev/authorizer/security/advisories/GHSA-h29v-hj44-q8cv)

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-12._