Skip to content
OpenAdvisories

Package · Go

github.com/authorizerdev/authorizer

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High —
    CVE-2026-35511

    Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

    The OAuth callback handler links incoming OAuth identities (Google, GitHub, etc.) to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim…

    github.com/authorizerdev/authorizer Go
  • High —
    GHSA-x3f4-v83f-7wp2

    Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

    Hi, I found that 6 endpoints in Authorizer accept a user-controlled `redirect_uri` and append sensitive tokens to it without validating the URL against `AllowedOrigins`. The OAuth `/app` handler validates redirect_uri at `http_handlers/app.go:46`, but the Gra…

    github.com/authorizerdev/authorizer Go
  • High 7.3
    GHSA-jfwg-rxf3-p7r9

    Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

    ## Vulnerability Details **CWE:** CWE-943 - Improper Neutralization of Special Elements in Data Query Logic All 66+ CQL queries in `internal/storage/db/cassandradb/` use `fmt.Sprintf` to interpolate user-controlled values directly into CQL query strings witho…

    github.com/authorizerdev/authorizer Go