{"id":"CVE-2026-123196","kind":"vulnerability","aliases":["CVE-2026-123196"],"related":[],"title":"Authorizer: password reset poisoning lets attackers take over accounts","description":"Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.","summary":"Authorizer before 2.4.2 builds emailed password reset and magic links using a host supplied in x-authorizer-url gRPC metadata or a Grpc-Metadata-X-Authorizer-Url header. An unauthenticated attacker can point those links at a host they control, capture the reset or magic-link token, and take over accounts.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","authorizer","grpc","package","self-hosted"],"not_affected_if":["no-external-grpc-access","version-2.4.2-or-later"],"how_to_check":"- Check the Authorizer version in use; releases before `2.4.2` are affected.\n- Check whether the gRPC port or the REST gateway is reachable from untrusted networks.\n- Check whether the gateway forwards a Grpc-Metadata-X-Authorizer-Url header from clients.","fix":"- Authorizer: upgrade to `2.4.2` or later.","status":"open","published_at":"2026-11-05T19:17:17+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","triaged_at":"2026-11-05T19:42:43+00:00","updated_at":"2026-11-05T19:42:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- Authorizer: upgrade to `2.4.2` or later.","reach":"internet","title":"Authorizer: password reset poisoning lets attackers take over accounts","impact":"high","summary":"Authorizer before 2.4.2 builds emailed password reset and magic links using a host supplied in x-authorizer-url gRPC metadata or a Grpc-Metadata-X-Authorizer-Url header. An unauthenticated attacker can point those links at a host they control, capture the reset or magic-link token, and take over accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["authorizer","self-hosted","grpc","authentication"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker captures reset tokens and takes over user accounts","analyst_note":"","how_to_check":"- Check the Authorizer version in use; releases before `2.4.2` are affected.\n- Check whether the gRPC port or the REST gateway is reachable from untrusted networks.\n- Check whether the gateway forwards a Grpc-Metadata-X-Authorizer-Url header from clients.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.4.2-or-later","no-external-grpc-access"],"who_is_affected":"Deployments of Authorizer, the open-source authentication service, running a version before 2.4.2. Exposure is greatest where the gRPC port or the REST gateway accepts requests from untrusted clients, since those requests can set the link host. Teams that run it only behind a private network with no external access to these interfaces are less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4331,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123196':12A,15A '-2026':11A,14A '2.4.2':25B,79C 'account':9A,76B,136C 'allow':87C 'attack':6A,55B,89C,103C 'authent':16B 'author':1A,17B,23B,40B,50B,77C,99C,118C 'build':26B 'captur':65B,126C 'contain':80C 'control':64B,91C 'cve':10A,13A 'email':27B,92C 'gateway':124C 'grpc':18B,42B,47B,101C,110C,115C 'grpc-metadata-x-authorizer-url':46B,114C 'header':52B,120C 'host':22B,35B,62B,94C 'let':5A 'link':32B,59B,71B,93C,131C 'magic':31B,70B,130C 'magic-link':69B,129C 'metadata':43B,48B,102C,107C,116C 'packag':19B 'password':2A,28B,82C 'point':57B 'poison':4A,84C 'port':111C 'reset':3A,29B,67B,83C,127C 'rest':123C 'self':21B 'self-host':20B 'send':105C 'suppli':36B,96C 'take':7A,74B,134C 'token':72B,132C 'unauthent':54B,88C 'url':41B,51B,100C,119C 'use':33B 'vulner':85C 'x':39B,49B,98C,117C 'x-authorizer-url':38B,97C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Authorizer, the open-source authentication service, running a version before 2.4.2. Exposure is greatest where the gRPC port or the REST gateway accepts requests from untrusted clients, since those requests can set the link host. Teams that run it only behind a private network with no external access to these interfaces are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","authorizer","grpc","high","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-14T13:06:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123196","severity":null,"published_at":"2026-11-05T19:17:17+00:00","modified_at":"2026-11-05T19:17:18+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","fetched_at":"2026-11-05T19:40:35+00:00","note":null}],"documents":[{"id":79181,"url":"https://github.com/authorizerdev/authorizer/commit/b5012cbcdc7c32dcb4bd43179a212055e7fcb863","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79182,"url":"https://github.com/authorizerdev/authorizer/releases/tag/2.4.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79183,"url":"https://github.com/authorizerdev/authorizer/security/advisories/GHSA-m46m-j9p5-5j99","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-14T13:06:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":79184,"url":"https://www.vulncheck.com/advisories/authorizer-before-2.4.2-password-reset-poisoning-via-x-authorizer-url-grpc-metadata","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}