Authorizer versions before 2.4.2 suffer from password reset poisoning, allowing unauthenticated attackers to dictate the host used in reset or magic-link emails by embedding an x-authorizer-url value in gRPC metadata or a corresponding REST header. This manipulation leads to the interception of reset or magic-link tokens, granting the attacker unauthorized access to user accounts and full control over the compromised accounts.

Vendor: AuthorizerDev's authorizer service. Affected releases are any iterations prior to the 2.4.2 patch; the fix was introduced in the 2.4.2 release. Systems running earlier versions without the patch that expose the gRPC endpoint or REST gateway to external clients are considered vulnerable.

The CVSS score of 8.6 indicates a high severity, combining a high impact on confidentiality, integrity, and availability with a relatively high exploitability. The EPSS score is not available, and the vulnerability is currently not listed in the CISA Known Exploited Vulnerabilities catalog, implying limited but plausible exploitation opportunities. Attackers can exploit the flaw remotely over the gRPC port or via REST gateway headers, requiring no prior authentication, which makes the vector easily reachable from an external network.