An unauthenticated open redirect vulnerability in the authorizer server allows attackers to exfiltrate sensitive authentication tokens, posing a critical risk to user account security.

This is an open redirect flaw (CWE-601) occurring within the /authorize endpoint. An unauthenticated attacker can supply a malicious redirect URI, which the server uses to redirect users while appending sensitive access, ID, and refresh tokens to the URL.

The exploitation of this vulnerability allows for the immediate theft of authentication tokens, leading to full unauthorized access to user accounts. With a CVSS score of 9.3, this flaw represents a critical risk that could result in significant data breaches and identity compromise. The ability to intercept these tokens without any prior authentication makes this an exceptionally attractive target for malicious actors.

Immediate Action: Upgrade the authorizer server to version 2.2.1 or later to implement proper validation of the redirect URI against the configured AllowedOrigins.

Proactive Monitoring: Review web server and application logs for suspicious 302 redirect patterns or requests to the /authorize endpoint containing unexpected or external domains in the redirect_uri parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests to the /authorize endpoint that contain suspicious or non-whitelisted domains within the redirect_uri query parameter.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this vulnerability and the potential for total account takeover, organizations must prioritize upgrading to version 2.2.1 immediately. Failure to patch this endpoint leaves the authentication flow exposed to token interception, which directly facilitates secondary attacks against the user base.