CVE-2026-54072 describes an unvalidated redirect_uri vulnerability in the /authorize endpoint of github.com/authorizerdev/authorizer. The endpoint accepts any redirect_uri without checking it against the configured AllowedOrigins. When response_type=token or id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql?query={meta{client_id}} endpoint. This flaw allows an attacker to steal OAuth2 tokens by tricking a logged-in user into clicking a crafted link, enabling impersonation of the victim. A partial fix was applied in version 2.0.1 to other OAuth handlers but not to /authorize. The proposed fix is to add an IsValidOrigin check for redirect_uri in /authorize, rejecting unauthorized redirect URIs with an error response.

An attacker can steal access_token, id_token, and refresh_token by tricking a logged-in user into clicking a maliciously crafted link with an attacker-controlled redirect_uri. The attacker can then impersonate the victim for the full token lifetime without further user interaction. This leads to a complete compromise of the victim's OAuth2 session and associated privileges.

A patch is available that adds validation of the redirect_uri parameter against the configured AllowedOrigins in the /authorize endpoint. This validation rejects unauthorized redirect URIs with an error response, preventing token leakage. Users should upgrade to a version including this fix or apply the proposed code change to ensure redirect_uri validation is enforced in /authorize as it is in other OAuth handlers.