GHSA-X3F4-V83F-7WP2: authorizer Go
CVSS: 8.6v4.0HighPublished
AliasesGO-2026-5737
Published 25-06-2026Last modified 25-06-2026
Vulnerability summary
GHSA-X3F4-V83F-7WP2 is a high (CVSS 8.6) vulnerability in authorizer Go.
CVSS score
8.6/10
010
High · v4.0 (OSV · Go), selected by version preferenceEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 25-06-2026PublishedVulnerability first disclosed.
- 25-06-2026Last modifiedVulnerability information updated.
Description
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri in github.com/authorizerdev/authorizer
CVSS metrics
1 score · 1 source · 1 versionHigh 8.6Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesSingle source
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Github.com/authorizerdev1 product
- authorizer< 0.0.0-20260329085140-6d9bef1aaba3
1 vendor · 1 product