Threats affecting pkg:golang/authorizer

Authorizer versions from 2.3.0-rc.3 up to but not including 2.4.2 contain a password reset poisoning vulnerability. This flaw allows unauthenticated attackers to manipulate the host in password reset links by supplying crafted x-authorizer-url gRPC metadata. Exploitation can occur via the gRPC port or through a specific HTTP header in the REST gateway, enabling attackers to capture reset or magic-link tokens and potentially take over user accounts. The vulnerability is rated high severity with a CVSS score of 8.6. A fix is available in version 2.4.2.