Authorizer vulnerabilities

The Authorizer plugin in versions up to and including 3.15.3 contains an unauthenticated privilege escalation vulnerability.

In Authorizer prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. With response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql endpoint.

Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.