The vulnerability in github.com/authorizerdev/authorizer's /authorize endpoint arises because it accepts any redirect_uri without validating it against the configured AllowedOrigins. When the response_type is token or id_token, the server includes access_token, id_token, and refresh_token in the redirect URL query parameters and issues a 302 redirect to the supplied redirect_uri. An attacker can obtain the client_id from a public GraphQL endpoint and craft a malicious URL that, when visited by a logged-in user, causes the tokens to be sent to an attacker-controlled URL. A partial fix was applied in version 2.0.1 to other OAuth handlers but not to /authorize. The proposed fix is to add an origin validation check similar to other handlers to reject unauthorized redirect_uris.

An attacker who convinces a logged-in user to visit a crafted URL can steal the victim's OAuth2 tokens (access_token, id_token, refresh_token). With these tokens, the attacker can impersonate the victim for the full token lifetime. No additional user interaction beyond clicking the link is required, as the victim's browser automatically follows the redirect containing the tokens. This leads to a critical compromise of user accounts and session integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The proposed fix is to implement validation of the redirect_uri parameter against the configured AllowedOrigins in the /authorize endpoint, rejecting requests with unauthorized redirect_uris. This matches the partial fix applied in version 2.0.1 to other OAuth handlers. Until a patch is available, avoid exposing the /authorize endpoint or restrict usage to trusted clients only.