GHSA-m46m-j9p5-5j99: Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata

Published Nov 5, 2026

Updated

Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.

Event History

Nov 5, 2026

CVE Published

via OSV·06:16 PM

Data Sourced

via OSV·06:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Authorizer deployments running a version before 2.4.2 are affected where attackers can reach the gRPC port or can send requests through the REST gateway.

What does an attacker need to exploit it?

No authentication is required. The attacker must induce a password-reset or magic-link flow while supplying x-authorizer-url as gRPC metadata, or Grpc-Metadata-X-Authorizer-Url through the REST gateway.

What is the account-impact scenario?

The supplied metadata can control the host used in emailed reset or magic links. This can allow an attacker to capture the resulting tokens and take over affected user accounts.

GHSA-m46m-j9p5-5j99: Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the account-impact scenario?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the account-impact scenario?