CVE-2026-123196
Description
A flaw was found in Authorizer. This vulnerability allows an unauthenticated remote attacker to conduct password reset poisoning by providing manipulated metadata headers, such as x-authorizer-url, through the gRPC or REST interfaces. As a result, the application generates password reset and login emails with attacker-controlled links, enabling the attacker to intercept authentication tokens and take over user accounts.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote adversary can inject external host metadata into outbound authentication messages, leading to credential theft and account compromise. The risk is bounded to Important rather than Critical because successful exploitation depends on victim interaction to follow the tampered link. Authorizer is not packaged or distributed within Red Hat Enterprise Linux or any supported Red Hat solutions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce the configured server base URL and prevent untrusted caller-supplied host metadata from driving outgoing authentication link generation across gRPC and REST gateway interfaces: upgrade to Authorizer 2.4.2, which prioritize configured trusted URL over gRPC metadata and block X-Authorizer-Url header variants in the REST gateway incoming-header matcher, closing all 2 injection vectors (direct gRPC metadata injection via x-authorizer-url, REST gateway header injection via Grpc-Metadata-X-Authorizer-Url). Until patched, this is a concern on Authorizer deployments with network-exposed gRPC or REST gateway interfaces and active email delivery, so Restrict network access to Authorizer gRPC and REST gateway endpoints to trusted reverse proxies and block incoming Grpc-Metadata-X-Authorizer-Url and x-authorizer-url headers at perimeter proxies. These controls limit blast radius and contain exploitation, but they do not fix the underlying password reset poisoning defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
Weak password recovery schemes completely undermine a strong password authentication scheme. An attacker could gain unauthorized access to the system by retrieving a legitimate user's authentication credentials.
Availability
Technical Impact: DoS: Resource Consumption (Other)
An attacker could deny service to legitimate system users by launching a brute force attack on the password recovery mechanism using user ids of legitimate users.
Integrity,Other
Technical Impact: Other
The system's security functionality is turned against the system by the attacker.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
