Skip to content
Threat Feed
Subscribe

Product

Authorizer (< 0.0.0-20260409051328-Bd3f5baf6d3d)

1 brief RSS
critical advisory

Authorizer Unvalidated Redirect Vulnerability Allows OAuth2 Token Theft

An unvalidated redirect vulnerability, CVE-2026-54072, in the Authorizer `/authorize` endpoint allows an unauthenticated attacker to steal OAuth2 access, ID, and refresh tokens by crafting a malicious URL with an attacker-controlled `redirect_uri` to which the application redirects a logged-in user, exposing their tokens.

authorizer oauth vulnerability redirect token-theft web ghsa
1r 2t 1i