Skip to content
Threat Feed
Subscribe

Product

Authorizer

2 briefs RSS
high advisory

Authorizer Zero-Click Account Takeover via OAuth Identity Linking

Authorizer suffers from a zero-click account takeover vulnerability (CVE-2026-35511) where attackers can link OAuth identities to unverified accounts, gaining persistent password access to victim accounts.

authorizer account-takeover oauth authentication-bypass cve-2026-35511
2t
high advisory

Authorizer Unvalidated Redirect URI Vulnerability

Authorizer is vulnerable to unvalidated redirect URI injection in multiple endpoints, allowing attackers to steal password reset tokens, magic link tokens, and full authentication tokens by redirecting users to attacker-controlled sites.

Authorizer redirect-uri account-takeover authorization
2r 1t 1i