authorizerdev CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL authorizerdev CVE published 2026-09-11

CVE-2026-54072

CVE-2026-54072 is a critical vulnerability in the Authorizer open-source authentication and authorization server. The `/authorize` endpoint accepts any `redirect_uri` without validation, allowing an unauthenticated attacker to obtain sensitive tokens by redirecting the victim to a malicious URL. The vulnerability has a CVSS score of 9.3 and was partially fixed in version 2.0.1 but fully addressed in version 2.2.1.