CVE-2026-123196

{
  "etk_id": "ETK-2026-3683",
  "cve_id": "CVE-2026-123196",
  "display_id": "CVE-2026-123196",
  "ghsa_id": "GHSA-4q96-hqv8-w3gh",
  "euvd_id": "EUVD-2026-117641",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Password reset link poisoning in Authorizer",
  "summary": "Authorizer releases before 2.4.2 can generate password-reset and magic-link emails with an attacker-controlled destination host. An unauthenticated attacker may capture authentication tokens and take over accounts when they can reach the affected gRPC service or REST gateway and users follow the emailed link.",
  "mitigation": "Upgrade Authorizer to version 2.4.2 or later. Until upgraded, restrict untrusted access to the gRPC service and REST gateway, especially endpoints that initiate password-reset or magic-link flows.",
  "vendor": "authorizerdev",
  "product": "Authorizer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.3.0-rc.3, < 2.4.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.4.2"
      ],
      "package_name": "authorizer",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 14.728448766666666,
  "t0_at": "2026-11-05T18:16:34.386000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T00:08:48.599511+00:00",
      "days": 0.2446089526736111,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T18:16:34.386000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T18:16:34.386000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T18:16:34.386000+00:00",
      "url": "https://github.com/advisories/GHSA-4q96-hqv8-w3gh"
    }
  }
}