7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jfwg-rxf3-p7r9

GHSA-jfwg-rxf3-p7r9: Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

Vulnerability Details

CWE: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

All 66+ CQL queries in internal/storage/db/cassandradb/ use fmt.Sprintf to interpolate user-controlled values directly into CQL query strings without parameterization.

Unauthenticated endpoints (signup, login, forgot_password, magic_link_login) pass user input directly into CQL query strings.

Note: This advisory covers the Cassandra CQL injection only. The Couchbase N1QL injection is tracked in a separate advisory per CVE rule 4.2.11.

Affected Code Pattern

// Before (VULNERABLE) - e.g. cassandradb/user.go
query := fmt.Sprintf("SELECT ... FROM %s WHERE email = '%s'", table, email)
err := p.db.Query(query).Scan(...)

Steps to Reproduce

Deploy Authorizer <= 2.0.0 with Cassandra backend
Send a signup request with a CQL injection payload in the email field:

curl -X POST http://localhost:8080/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query":"mutation { signup(params: { email: \"test'\" }) { message } }"}'

The single quote breaks out of the CQL string literal, causing a CQL parse error that leaks internal schema information
Crafted payloads can manipulate query logic to bypass authentication or extract data

Affected Files (10 Cassandra files)

| Package | File | Queries Fixed | |---------|------|--------------| | cassandradb | user.go | 7 | | cassandradb | otp.go | 4 | | cassandradb | session_token.go | 19 | | cassandradb | verification_requests.go | 4 | | cassandradb | authenticator.go | 3 | | cassandradb | email_template.go | 5 | | cassandradb | webhook.go | 5 | | cassandradb | webhook_log.go | 2 | | cassandradb | session.go | 1 | | cassandradb | env.go | 2 |

Impact

An unauthenticated attacker can inject arbitrary CQL operators through the email, phone, or token parameters on public-facing endpoints (signup, login, forgot_password, magic_link_login). This enables authentication bypass and data exfiltration from the Cassandra keyspace.

Proposed Fix

Use parameterized queries:

// After (FIXED)
query := fmt.Sprintf("SELECT ... FROM %s WHERE email = ?", table)
err := p.db.Query(query, email).Scan(...)

Fixed in https://github.com/authorizerdev/authorizer/pull/500 (merged 2026-03-27).

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jfwg-rxf3-p7r9

GHSA-jfwg-rxf3-p7r9:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/authorizerdev/authorizer	go	< 0.0.0-20260327055742-73679faa53cd	0.0.0-20260327055742-73679faa53cd

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the use of fmt.Sprintf to construct CQL queries across multiple files in the internal/storage/db/cassandradb/ directory. User-controllable input is directly concatenated into the query string, leading to a CQL injection vulnerability. The patch replaces all instances of fmt.Sprintf-based query construction with parameterized queries, using ? as placeholders for values. This prevents attackers from manipulating the query structure. The analysis of the provided commit shows the widespread nature of this vulnerability across the Cassandra database backend, affecting numerous functions that perform database operations.