Password Reset Poisoning Vulnerability in Authorizer by AuthorizerDev
CVE-2026-123196

8.6HIGH

Key Information:

Vendor

Authorizerdev

Status
Authorizer
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123196?

The Authorizer product prior to version 2.4.2 is susceptible to a password reset poisoning vulnerability. This flaw permits unauthenticated attackers to manipulate the hosts of emailed links by injecting malicious x-authorizer-url gRPC metadata. By directing this metadata to the gRPC port or utilizing the Grpc-Metadata-X-Authorizer-Url header through the REST gateway, adversaries can capture reset or magic-link tokens, potentially leading to unauthorized account takeovers. Prompt action is required to secure user accounts and mitigate risks associated with this vulnerability.

Affected Version(s)

authorizer 2.3.0-rc.3 < 2.4.2

References

https://github.com/authorizerdev/authorizer/security/advi...
vendor-advisory
https://github.com/authorizerdev/authorizer/pull/814
issue-trackingpatch
https://github.com/authorizerdev/authorizer/commit/b5012c...
patch

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Theodoros Lampropoulos
Lakhan Samani (lakhansamani)
.