{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123196", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T17:58:42.822Z", "datePublished": "2026-11-05T18:16:34.386Z", "dateUpdated": "2026-11-05T18:16:34.386Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:34.386Z"}, "datePublic": "2026-10-14T00:00:00.000Z", "title": "Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata", "descriptions": [{"lang": "en", "value": "Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Weak Password Recovery Mechanism for Forgotten Password", "cweId": "CWE-640", "type": "CWE"}]}], "affected": [{"vendor": "authorizerdev", "product": "authorizer", "defaultStatus": "unaffected", "versions": [{"version": "2.3.0-rc.3", "lessThan": "2.4.2", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/authorizerdev/authorizer", "repo": "https://github.com/authorizerdev/authorizer"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/authorizerdev/authorizer/security/advisories/GHSA-m46m-j9p5-5j99", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-m46m-j9p5-5j99)"}, {"url": "https://github.com/authorizerdev/authorizer/pull/814", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/authorizerdev/authorizer/commit/b5012cbcdc7c32dcb4bd43179a212055e7fcb863", "tags": ["patch"]}, {"url": "https://github.com/authorizerdev/authorizer/releases/tag/2.4.2", "tags": ["release-notes"], "name": "authorizer 2.4.2 Release Notes"}, {"url": "https://github.com/authorizerdev/authorizer/blob/0bceb94f0ab726d9c396202f4d8fbedee1dc9cab/internal/grpcsrv/transport/grpc_metadata.go#L40", "tags": ["technical-description"]}, {"url": "https://github.com/authorizerdev/authorizer/blob/0bceb94f0ab726d9c396202f4d8fbedee1dc9cab/internal/gateway/mount.go#L244-L248", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/authorizer-before-2.4.2-password-reset-poisoning-via-x-authorizer-url-grpc-metadata"}], "credits": [{"lang": "en", "value": "Theodoros Lampropoulos", "type": "finder"}, {"lang": "en", "value": "Lakhan Samani (lakhansamani)", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/authorizerdev/authorizer", "product": "authorizer", "repo": "https://github.com/authorizerdev/authorizer", "vendor": "authorizerdev", "versions": [{"lessThan": "2.4.2", "status": "affected", "version": "2.3.0-rc.3", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts."}], "id": "CVE-2026-123196", "lastModified": "2026-11-05T19:17:18.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T19:17:17.967", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/authorizerdev/authorizer/blob/0bceb94f0ab726d9c396202f4d8fbedee1dc9cab/internal/gateway/mount.go#L244-L248"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/authorizerdev/authorizer/blob/0bceb94f0ab726d9c396202f4d8fbedee1dc9cab/internal/grpcsrv/transport/grpc_metadata.go#L40"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/authorizerdev/authorizer/commit/b5012cbcdc7c32dcb4bd43179a212055e7fcb863"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/authorizerdev/authorizer/pull/814"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/authorizerdev/authorizer/releases/tag/2.4.2"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/authorizerdev/authorizer/security/advisories/GHSA-m46m-j9p5-5j99"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/authorizer-before-2.4.2-password-reset-poisoning-via-x-authorizer-url-grpc-metadata"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/authorizerdev/authorizer: Authorizer: Account takeover via password reset poisoning", "id": "2567649", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567649"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-640", "details": ["A flaw was found in Authorizer. This vulnerability allows an unauthenticated remote attacker to conduct password reset poisoning by providing manipulated metadata headers, such as x-authorizer-url, through the gRPC or REST interfaces. As a result, the application generates password reset and login emails with attacker-controlled links, enabling the attacker to intercept authentication tokens and take over user accounts."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123196", "public_date": "2026-11-05T18:16:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123196\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123196\nhttps://github.com/authorizerdev/authorizer/blob/0bceb94f0ab726d9c396202f4d8fbedee1dc9cab/internal/gateway/mount.go#L244-L248\nhttps://github.com/authorizerdev/authorizer/blob/0bceb94f0ab726d9c396202f4d8fbedee1dc9cab/internal/grpcsrv/transport/grpc_metadata.go#L40\nhttps://github.com/authorizerdev/authorizer/commit/b5012cbcdc7c32dcb4bd43179a212055e7fcb863\nhttps://github.com/authorizerdev/authorizer/pull/814\nhttps://github.com/authorizerdev/authorizer/releases/tag/2.4.2\nhttps://github.com/authorizerdev/authorizer/security/advisories/GHSA-m46m-j9p5-5j99\nhttps://www.vulncheck.com/advisories/authorizer-before-2.4.2-password-reset-poisoning-via-x-authorizer-url-grpc-metadata"], "statement": "This vulnerability is rated as Important severity because an unauthenticated remote adversary can inject external host metadata into outbound authentication messages, leading to credential theft and account compromise. The risk is bounded to Important rather than Critical because successful exploitation depends on victim interaction to follow the tampered link. Authorizer is not packaged or distributed within Red Hat Enterprise Linux or any supported Red Hat solutions.", "threat_severity": "Important"}