Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata
Authorizer 2.3.0-rc.3 through 2.4.1 with SMTP configured can send password-reset emails pointing at an attacker host. CVSS rates it 8.6 High; no vendor rating is given. Fixed in 2.4.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.4.2
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Authorizer versions >= 2.3.0-rc.3 up to and including 2.4.1 are affected. The gRPC listener is reachable directly, or the REST gateway is reachable and accepts the Grpc-Metadata-X-Authorizer-Url header. SMTP is configured so that password-reset or magic-link emails are sent. Magic-link login additionally requires the magic-link login and email verification features to be enabled. The victim must follow the emailed link.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Authorizer, an authentication software, is affected by a password reset poisoning flaw that lets an unauthenticated attacker remotely take over user accounts by capturing reset or magic-link tokens. Exploitation requires a victim to take an action, such as clicking a link in an email.
Read the original description
Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.6/10CVSS 8.6
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
Authorizer versions >= 2.3.0-rc.3 up to and including 2.4.1 are affected. The gRPC listener is reachable directly, or the REST gateway is reachable and accepts the Grpc-Metadata-X-Authorizer-Url header. SMTP is configured so that password-reset or magic-link emails are sent. Magic-link login additionally requires the magic-link login and email verification features to be enabled. The victim must follow the emailed link.Upgrade to a fixed version: 2.4.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- authorizerdev authorizer
From 2.3.0-rc.3 · fixed in 2.4.2
Evidence 7
- Advisory
- Patch
- Patch
- Repository
- Repository
Show all 7 sourcesShow fewer sources
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123196
Is CVE-2026-123196 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An attacker can send a crafted gRPC metadata header, x-authorizer-url, so that a password-reset or magic-link email points at a host the attacker controls. If the victim follows the link, the attacker can capture the reset or magic-link token and take over the account.Source: github.com, vulncheck.com
Which versions are affected by CVE-2026-123196?
authorizer: from 2.3.0-rc.3 before 2.4.2.Source: cve.now feed data
Am I affected, and how do I check?
Versions 2.3.0-rc.3 up to and including 2.4.1 are affected, when SMTP is configured to send password-reset or magic-link emails. Magic-link login also requires the magic-link login and email verification features to be enabled. Check your version and whether the gRPC port is reachable or the REST gateway accepts the Grpc-Metadata-X-Authorizer-Url header.Source: github.com, vulncheck.com
How do I fix CVE-2026-123196?
Upgrade Authorizer to version 2.4.2, which fixes this issue.Source: github.com, vulncheck.com