Security: authorizerdev/authorizer
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
TOTP recovery codes are not single-use under concurrency, allowing one code to bypass MFA repeatedlyGHSA-xc9v-r84m-4qx9 published
Aug 13, 2026 by lakhansamaniModerate -
Social-login state parameter injection lets a caller forge the callback redirect URI and assigned rolesGHSA-fxxg-mx7x-3rx8 published
Aug 13, 2026 by lakhansamaniModerate -
SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook and OIDC endpoint validationGHSA-qxfq-3qvw-w5fr published
Aug 14, 2026 by lakhansamaniHigh -
Password Reset Poisoning via Host Header InjectionGHSA-m82j-rq33-qjx2 published
Aug 14, 2026 by lakhansamaniHigh -
redirect_uri / CORS origin allowlist bypass via unescaped regex dots — incomplete fix of GHSA-x3f4-v83f-7wp2GHSA-89vc-q979-qwxv published
Aug 14, 2026 by lakhansamaniHigh -
Unauthenticated privilege escalation via signup roles parameter (bypass of --protected-roles)GHSA-845v-5ggv-pwfp published
Aug 13, 2026 by lakhansamaniCritical -
Timing Attack in Login ValidationGHSA-c2mx-6qjh-6ppj published
Aug 13, 2026 by lakhansamaniHigh -
Open Redirect Vulnerability in OAuth Login HandlerGHSA-j558-mp2m-fhrp published
Aug 14, 2026 by lakhansamaniHigh -
N1QL Injection in Couchbase Backend via fmt.Sprintf String InterpolationGHSA-24gq-v8fq-ph9w published
Aug 13, 2026 by lakhansamaniHigh -
Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URLGHSA-h29v-hj44-q8cv published
Jun 3, 2026 by lakhansamaniCritical