Threats tagged 'ghsa-4q96-hqv8-w3gh'

Authorizer versions before 2.4.2 have a password reset poisoning vulnerability. This flaw allows unauthenticated attackers to manipulate the host in emailed password reset links by supplying crafted x-authorizer-url gRPC metadata. Attackers can exploit this by sending the metadata to the gRPC port or via a Grpc-Metadata-X-Authorizer-Url header through the REST gateway, enabling them to capture reset or magic-link tokens and potentially take over user accounts.