Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/authorizerdev/authorizer < 0.0.0-20260807033110-66fe488fd2a4
Fixed in
0.0.0-20260807033110-66fe488fd2a4· Vendor fix available
Issue
The OAuth callback handler links incoming OAuth identities (Google, GitHub, etc.) to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address (without verifying it) gains persistent password-based access to the victim's account after the victim completes a normal OAuth login. Verified against HEAD (commit 73679fa). Root Cause In internal/httphandlers/oauthcallback.go, when an OAuth login occurs for an email that already exists in the database: Line 125: The existing user is looked up by email: existingUser, err := h.StorageProvider.GetUserByEmail(ctx, refs.StringValue(user.Email)) Line 164: The OAuth user object is replaced with the existing user: user = existingUser Lines 173-176: The OAuth provider is appended to the existing user's signup methods: signupMethod := existingUser.SignupMethods if !strings.Contains(signupMethod, provider) { signupMethod…
Recommended action: Upgrade to 0.0.0-20260807033110-66fe488fd2a4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/authorizerdev/authorizer < 0.0.0-20260409051328-bd3f5baf6d3d
Fixed in
0.0.0-20260409051328-bd3f5baf6d3d· Vendor fix available
Issue
The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the required clientid from the public /graphql?query={meta{clientid}} endpoint. Partial fix was applied in v2.0.1 to other handlers (oauthlogin, verifyemail, magiclinklogin, forgotpassword, invitemembers, oauthcallback) but /authorize was not included. Vulnerable Code internal/httphandlers/authorize.go: Compare with the fixed oauthlogin.go in v2.0.1 which calls validators.IsValidOrigin(redirectURI, h.Config.AllowedOrigins). Steps to Reproduce Impact An attacker who tricks a logged-in user into clicking a crafted link can steal the victim's accesstoken, idtoken, and refreshtoken. The attacker can then impersonate the victim for the full token lifetime. No user…
Recommended action: Upgrade to 0.0.0-20260409051328-bd3f5baf6d3d (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/authorizerdev/authorizer < 0.0.0-20260329085140-6d9bef1aaba3
Fixed in
0.0.0-20260329085140-6d9bef1aaba3· Vendor fix available
Issue
Hi, I found that 6 endpoints in Authorizer accept a user-controlled redirecturi and append sensitive tokens to it without validating the URL against AllowedOrigins. The OAuth /app handler validates redirecturi at httphandlers/app.go:46, but the GraphQL mutations and verifyemail handler skip validation entirely. An attacker can steal password reset tokens, magic link tokens, and full auth sessions (accesstoken + idtoken + refreshtoken) by pointing redirecturi to their server. Verified against HEAD (commit 73679fa). Affected Endpoints 1. ForgotPassword (internal/graphql/forgotpassword.go:76-77) - password reset tokens 2. MagicLinkLogin (internal/graphql/magiclinklogin.go:150-151) - magic link auth tokens 3. Signup (internal/graphql/signup.go:211-212) - email verification tokens 4. InviteMembers (internal/graphql/invitemembers.go:90-91) - invitation tokens 5. OAuthLoginHandler (internal/httphandlers/oauthlogin.go:18-20) - OAuth redirect stored in state 6. VerifyEmailHandler…
Recommended action: Upgrade to 0.0.0-20260329085140-6d9bef1aaba3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/authorizerdev/authorizer < 0.0.0-20260327055742-73679faa53cd
Fixed in
0.0.0-20260327055742-73679faa53cd· Vendor fix available
Issue
Vulnerability Details CWE: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic All 66+ CQL queries in internal/storage/db/cassandradb/ use fmt.Sprintf to interpolate user-controlled values directly into CQL query strings without parameterization. Unauthenticated endpoints (signup, login, forgotpassword, magiclinklogin) pass user input directly into CQL query strings. Note: This advisory covers the Cassandra CQL injection only. The Couchbase N1QL injection is tracked in a separate advisory per CVE rule 4.2.11. Affected Code Pattern Steps to Reproduce 1. Deploy Authorizer <= 2.0.0 with Cassandra backend 2. Send a signup request with a CQL injection payload in the email field: 3. The single quote breaks out of the CQL string literal, causing a CQL parse error that leaks internal schema information 4. Crafted payloads can manipulate query logic to bypass authentication or extract data Affected Files (10 Cassandra files) | Package | File | Queries Fixed |…
Recommended action: Upgrade to 0.0.0-20260327055742-73679faa53cd (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.