CVE-2026-123196 · Package
NO FIX YET · SEE WHAT TO DO
Authorizer before 2.4.2 builds emailed password reset and magic links using a host supplied in x-authorizer-url gRPC metadata or a Grpc-Metadata-X-Authorizer-Url header. An unauthenticated attacker can point those links at a host they control, capture the reset or magic-link token, and take over accounts.
first public Oct 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Authorizer, the open-source authentication service, running a version before 2.4.2. Exposure is greatest where the gRPC port or the REST gateway accepts requests from untrusted clients, since those requests can set the link host. Teams that run it only behind a private network with no external access to these interfaces are less exposed.
Not affected if no-external-grpc-access, version-2.4.2-or-later
Who cares authentication, authorizer, grpc, self-hosted
2.4.2 are affected.2.4.2 or later.Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.