Authorizer password reset link host poisoning via gRPC metadata

Password-reset emails on a login server can be redirected to attacker sites.

Summary

Attackers can make the Authorizer login server put their own host into password-reset and magic-link emails, letting them take over accounts. Versions from 2.3.0-rc.3 through 2.4.1 are affected on servers that send email.

Affected when

SMTP email configured
gRPC port reachable from outside, or REST gateway in use
For magic links: --enable-magic-link-login and --enable-email-verification enabled

What to do

Update to 2.4.2 or later. See the official advisory for details.

Products and platforms

Windows
macOS
Linux
authorizerdev authorizer

CVE IDs

CVE-2026-123196 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-05 18:16 UTC

First seen 2026-11-09 17:00 UTC