CVE-2025-59934 Details

A critical vulnerability exists in Formbricks, an open-source alternative to Qualtrics, prior to version 4.0.1. The issue arises from the absence of JSON Web Token (JWT) signature verification in the token validation process. Instead of using 'jwt.verify()' to validate signatures, the application only decodes the tokens with 'jwt.decode()', leaving them unchecked and vulnerable to manipulation. This flaw is present in both the email verification token login path and the password reset server action, which rely on the same validator that fails to verify the token's signature, expiration, issuer, or audience. As a result, an attacker who obtains a victim's user ID can create a fraudulent JWT with an 'alg: none' header, bypass authentication, and reset the victim's password.

Users can update to Formbricks version 4.0.1 or later, where this vulnerability has been patched.