N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-x3f4-v83f-7wp2

GHSA-x3f4-v83f-7wp2: Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

Hi,

I found that 6 endpoints in Authorizer accept a user-controlled redirect_uri and append sensitive tokens to it without validating the URL against AllowedOrigins. The OAuth /app handler validates redirect_uri at http_handlers/app.go:46, but the GraphQL mutations and verify_email handler skip validation entirely. An attacker can steal password reset tokens, magic link tokens, and full auth sessions (access_token + id_token + refresh_token) by pointing redirect_uri to their server. Verified against HEAD (commit 73679fa).

Affected Endpoints

ForgotPassword (internal/graphql/forgot_password.go:76-77) - password reset tokens
MagicLinkLogin (internal/graphql/magic_link_login.go:150-151) - magic link auth tokens
Signup (internal/graphql/signup.go:211-212) - email verification tokens
InviteMembers (internal/graphql/invite_members.go:90-91) - invitation tokens
OAuthLoginHandler (internal/http_handlers/oauth_login.go:18-20) - OAuth redirect stored in state
VerifyEmailHandler (internal/http_handlers/verify_email.go:27,178) - full auth tokens (access + id + refresh)

Root Cause

Because these 6 endpoints completely lack the validators.IsValidOrigin() check, this vulnerability bypasses secure configurations. Even if a production administrator strictly configures AllowedOrigins to ["https://my-secure-app.com"], an attacker can still steal tokens by passing https://attacker.com to these specific GraphQL mutations. The validation only exists in the /app OAuth handler, not in any of the GraphQL mutations.

In forgot_password.go:76-77, the user-supplied is accepted without validation:

Miggo Vulnerability Database

→

GHSA-x3f4-v83f-7wp2

GHSA-x3f4-v83f-7wp2:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/authorizerdev/authorizer	go	< 0.0.0-20260329085140-6d9bef1aaba3	0.0.0-20260329085140-6d9bef1aaba3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in six different functions across the Authorizer codebase that handle user authentication and account management flows. These functions accepted a redirect_uri parameter from user input but failed to validate it against a centrally configured list of allowed origins (AllowedOrigins). The patch, identified in commit 6d9bef1aaba3f867f8c769b93eb7fc80e4e7b0a2, introduces a validation check using validators.IsValidOrigin in each of the affected functions. An attacker could exploit this by crafting a request with a redirect_uri pointing to a server they control. When a legitimate user interacts with the generated link (e.g., for a password reset or email verification), the sensitive token is appended to the URL and sent to the attacker's server. The most critical instance is in VerifyEmailHandler, which leaks the full authentication session tokens, allowing for immediate account takeover. The vulnerable functions are ForgotPassword, MagicLinkLogin, SignUp, InviteMembers (all GraphQL resolvers), and OAuthLoginHandler, VerifyEmailHandler (HTTP handlers).

Vulnerable functions

graphqlProvider.ForgotPassword

internal/graphql/forgot_password.go

The `ForgotPassword` function accepts a `redirect_uri` from the user and uses it to construct a password reset link without validating it against the list of allowed origins. This allows an attacker to specify a malicious `redirect_uri` and steal the password reset token when the user clicks the link.

graphqlProvider.InviteMembers

internal/graphql/invite_members.go

The `InviteMembers` function accepts a `redirect_uri` from the user and uses it to construct an invitation link without validating it against the list of allowed origins. This allows an attacker to specify a malicious `redirect_uri` and steal the invitation token when a user accepts the invitation.

graphqlProvider.MagicLinkLogin

internal/graphql/magic_link_login.go

The `MagicLinkLogin` function accepts a `redirect_uri` from the user and uses it to construct a magic login link without validating it against the list of allowed origins. This allows an attacker to specify a malicious `redirect_uri` and steal the magic link token for passwordless login.

graphqlProvider.SignUp

internal/graphql/signup.go

The `SignUp` function accepts a `redirect_uri` from the user and uses it to construct an email verification link without validating it against the list of allowed origins. This allows an attacker to specify a malicious `redirect_uri` and steal the email verification token.

httpProvider.OAuthLoginHandler

internal/http_handlers/oauth_login.go

The `OAuthLoginHandler` function takes a `redirect_uri` as a parameter during the OAuth login flow. It failed to validate this URI, allowing an attacker to set a malicious redirect location where sensitive OAuth state information could be captured.

httpProvider.VerifyEmailHandler

internal/http_handlers/verify_email.go

The `VerifyEmailHandler` function is used to verify a user's email address. It accepted a `redirect_uri` both as a query parameter and from within a JWT claim without proper validation. After successful verification, it would redirect the user to the unvalidated URI with the full set of authentication tokens (access, ID, and refresh), leading to complete account takeover.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-x3f4-v83f-7wp2: Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

Affected Endpoints

Root Cause

GHSA-x3f4-v83f-7wp2:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

N/A

N/A

GHSA-x3f4-v83f-7wp2: Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

Affected Endpoints

Root Cause

Most Severe Path: Full Token Theft via verify_email

PoC

Impact

Additional Note

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-x3f4-v83f-7wp2: Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

Affected Endpoints

Root Cause

GHSA-x3f4-v83f-7wp2:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

N/A

N/A

GHSA-x3f4-v83f-7wp2: Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

Affected Endpoints

Root Cause

Most Severe Path: Full Token Theft via verify_email

PoC

Impact

Additional Note

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI