CVE-2025-59934criticalCWE-287CWE-345CWE-347

CVE-2025-59934: critical vulnerability in formbricks

Formbricks missing JWT signature verification

Published · Updated

Follow this CVE+ Monitor formbricks

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 9.1%
In short

Formbricks doesn't verify that login and password reset tokens are legitimate, allowing attackers to forge fake tokens and take over accounts if they know a user's ID. This is a critical flaw because these tokens are the main security barrier protecting accounts.

Technical detail

Formbricks' JWT validation routine performs decoding without signature verification, allowing attackers to craft tokens with alg: "none" and bypass authentication controls. The vulnerability affects both email verification login and password reset endpoints; exploitation requires knowledge of the target user.id and results in account takeover via unauthorized password reset or session hijacking.

Summary generated and translated by AI from the official description.
Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
formbricks · formbricks
Related CVEs — formbricks

In the same product, most dangerous first.

CVE-2026-110620MEDIUMFormbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationIdEPSS 0.6%