CVE-2026-123196

The Authorizer software prior to version 2.4.2 is vulnerable to a password reset poisoning vulnerability (CWE-640). This flaw allows unauthenticated attackers to manipulate the host of emailed links by supplying the x-authorizer-url gRPC metadata. Attackers can deliver this metadata via the gRPC ...