Description

Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-05T19:17:17.967Z",
  "pubdate": "2026-11-05T19:17:17.967Z",
  "executiveSummary": "Authorizer versions prior to 2.4.2 are susceptible to a password reset poisoning vulnerability, classified as a Host Header Injection/Request Smuggling variant.\nThe vulnerability allows an unauthenticated remote attacker to manipulate the hostname generated in password reset or magic-link emails.\nBy injecting the 'x-authorizer-url' gRPC metadata header or the corresponding 'Grpc-Metadata-X-Authorizer-Url' HTTP header, an attacker forces the application to direct users to an attacker-controlled domain.\nWhen a victim triggers a password reset, the resulting email contains a malicious link rather than a legitimate one.\nSuccessful exploitation enables account takeover, as the attacker can intercept or monitor the reset token sent to the poisoned host URL.\nThe vulnerability poses a critical risk to user identity management and authentication integrity, as it bypasses standard authorization controls without requiring prior authentication.\nThis flaw underscores the risk of trusting externally provided metadata to influence backend email generation logic.",
  "technicalDetails": "The vulnerability resides in the way the Authorizer service processes gRPC metadata when constructing notification URLs for authentication workflows.\nThe application relies on the 'x-authorizer-url' metadata key to determine the base domain for security-sensitive links, such as password resets and magic-link authentication.\nIn affected versions, the input validation mechanism fails to sanitize or restrict the value provided in the 'x-authorizer-url' gRPC metadata field or the 'Grpc-Metadata-X-Authorizer-Url' HTTP header passed through the REST gateway.\nBecause the service treats this user-supplied input as a trusted source for generating callback URLs, an attacker can supply an arbitrary domain.\nThe attack flow proceeds as follows: First, the attacker identifies a target account's identifier. Second, the attacker initiates a password reset request while simultaneously sending a specially crafted gRPC request or REST call that includes the malicious 'x-authorizer-url' metadata.\nThe backend logic processes this request, consumes the malicious host header, and generates a reset link where the base URL is replaced with the attacker's server.\nThe system sends the email to the legitimate account holder containing the poisoned link. Upon the victim clicking the link, the security token is transmitted to the attacker's server, or the victim is redirected to a phishing site designed to capture credentials.\nThis vulnerability is particularly dangerous because it does not require the attacker to have administrative access or specific privileges; it is entirely unauthenticated.\nThe exposure is present on any network path where the gRPC port or the REST gateway is accessible, allowing for remote exploitation without interaction from the application's internal infrastructure.\nThe post-exploitation impact is the full compromise of user accounts, as the attacker gains the ability to reset credentials at will or intercept magic-link sessions, effectively bypassing password-based and token-based authentication mechanisms."
}