2.4.0-rc.20

Security release on top of 2.4.0-rc.19. Upgrading from rc.19 or earlier requires one configuration change — see Breaking change below.

This release closes four vulnerabilities found by verifying a backlog of community-reported security advisories. All four were confirmed live on main with a reproducing test before being fixed.

⚠️ Breaking change: --url is now required

Authorizer will refuse to start without a valid --url (e.g. --url=https://auth.example.com).

Without it, every self-referential URL this server emits — password-reset links, email-verification links, magic links, the JWT iss claim, the OIDC discovery and JWKS URLs — was derived from request headers. An unauthenticated attacker could send a forgot-password request carrying their own Host, and the victim would receive a genuine reset link pointing at the attacker's domain. Clicking it handed over the token, and because iss was validated against the same header-derived host, the attacker redeemed it by replaying the spoofed header. Account takeover with no prior access and no mailbox compromise (CWE-640).

An unusable value is refused too (--url=auth.example.com with no scheme, or one containing user info), because such a value was previously discarded and silently fell back to header derivation — looking configured while staying vulnerable.

--url is not --allowed-origins. You need both:

Flag	Answers	Shape
--url	What address is this server reachable at? Used for the links it emails, its iss claim, its OIDC discovery document.	One value, required
--allowed-origins	Which apps may this server redirect users and tokens to, and which browser origins may call it?	A list, wildcards allowed

Typically --url is your Authorizer deployment (https://auth.example.com) and --allowed-origins are your applications (https://app.example.com). They usually differ. Adding your app to --allowed-origins does not satisfy --url, and setting --url does not let you omit --allowed-origins.

One interaction worth knowing: when --allowed-origins is empty or *, redirects are restricted to the server's own host — which now comes from --url.

Security fixes

Redirect/CORS allowlist bypass via lookalike domains. An exact allowlist entry was spliced into a regular expression with its dots left unescaped, so https://login.acme.com compiled to ^login.acme.com$ where every . matches any character. An attacker who registered loginxacme.com or login-acme.com passed validation and received OAuth access tokens, ID tokens and password-reset tokens. Only the wildcard branch escaped its dots; the exact branch — the documented production hardening — did not. This was an incomplete fix of GHSA-x3f4-v83f-7wp2 / CVE-2026-54072.

Exact origins are now compared as strings, never as patterns. Wildcards are escaped whole with only the * re-opened. Both validators route through one matcher, since the duplicated blocks are how they came to diverge.

SSRF guard bypass via IPv6 transition addresses. The private-range blocklist did not cover the transition mechanisms that embed an IPv4 address inside an IPv6 one, so 2002:a9fe:a9fe:: (6to4) and 64:ff9b::a9fe:a9fe (NAT64) both reached 169.254.169.254, the cloud metadata endpoint, through webhook and OIDC endpoint validation. 2002::/16, 2001::/32, 64:ff9b::/96, 64:ff9b:1::/48, ::/128 and 100::/64 are now blocked. Admin-privileged to reach.

Password-reset poisoning via Host header. Closed by the --url requirement above.

Also in this release

SECURITY.md now states the three outcomes every report reaches — confirmed (reproduced with a failing test that ships with the fix), not accepted (closed with a written reason, original preserved), or needs-info — and AGENTS.md carries the triage runbook behind them.

Upgrade notes

Set --url and you are done. If you are upgrading from rc.15 or earlier, read the rc.16 notes first — that release carried the full 22-finding pre-release security audit. Note that rc.15 was tagged but its build was cancelled — no rc.15 image was ever published.

Matching SDK releases

SDK	Version
authorizer-js	4.0.0-rc.0 (npm rc tag)
authorizer-react	2.2.0-rc.7 (npm rc tag)
authorizer-go	v2.2.0-rc.5
authorizer-py	0.3.0rc4
authorizer-proto-go	v0.2.0-rc.1
authorizer-proto	0.2.0rc1