Formbricks Signature Verification Vulnerability Let Attackers Reset User Passwords Without Authorization
A critical security vulnerability has been identified in Formbricks, an open-source experience management platform. The flaw, designated as CVE-2025-59934, involves missing JWT signature verification, which can potentially lead to unauthorized account…
A critical security vulnerability has been identified in Formbricks, an open-source experience management platform. The flaw, designated as CVE-2025-59934, involves missing JWT signature verification, which can potentially lead to unauthorized account takeovers.
The issue affects all Formbricks versions prior to 4.0.1 and results from improper token validation. The vulnerability arises when the application uses jwt.decode() instead of jwt.verify() , allowing attackers to bypass authentication controls.
Security researcher mattinannt disclosed the vulnerability, classifying it as critical due to its potential to grant unauthorized access to user accounts. Formbricks has addressed this issue in version 4.0.1. However, organizations using older versions remain at risk.
The vulnerability is found in the token validation routine within /formbricks/apps/web/lib/jwt.ts . The verifyToken function decodes JWT tokens without performing necessary security checks, such as:
Digital signature verification Token expiration validation Issuer and audience verification
This function uses jwt.decode() , which merely parses the JWT structure without cryptographic validation, allowing any well-formed JWT to be treated as authentic.
A critical security vulnerability has been identified in Formbricks, an open-source experience management platform.
The vulnerability affects both email verification token login and password reset functionalities. During password reset requests, the system extracts the user ID from the JWT payload and updates the user's password without verifying the token's authenticity.
Attackers can exploit this by crafting malicious JWTs using the "alg": "none" algorithm header. By knowing a victim's user.id, attackers can forge unsigned tokens that pass for legitimate, enabling unauthorized access.
Risk Factors Details
Affected Products Formbricks < 4.0.1
Impact Account takeover through privilege escalation
Exploit Prerequisites Knowledge of victim's user.id, crafting a JWT with "alg": "none", submitting the crafted JWT
CVSS 3.1 Score 9.4 (Critical)
Organizations using affected versions of Formbricks should upgrade to version 4.0.1 or later. It is also advisable to review authentication logs for unusual password reset activities. The update rectifies the issue by implementing proper JWT signature verification using jwt.verify() , ensuring only cryptographically valid tokens can authenticate users.
Based on reporting by Cyber Security News.