PT-2025-18681 · Auth0 · Auth0 Account Link Extension

Published 2025-05-01 · Updated 2025-05-02 · CVE-2025-46345

Positive Technologies · (AI Summary)

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Auth0 Account Link Extension versions 2.3.4 through 2.6.6

Description The issue allows users to supply a forged token, potentially accessing user information without proper authorization, due to the lack of verification of the signature of the provided JWT.

Recommendations For versions 2.3.4 through 2.6.6, upgrade to version 3.0.0 or greater to resolve the issue.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-46345

GHSA-J2JH-RQFF-7VMG

Affected Products

Auth0 Account Link Extension

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46345.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46345 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46345 · Vendor Advisory
• https://github.com/auth0-extensions/auth0-account-link-extension/security/advisories/GHSA-j2jh-rqff-7vmg · Note
• https://github.com/auth0-extensions/auth0-account-link-extension/pull/187 · Note
• https://t.me/cvetracker/22852 · Telegram Post
• https://twitter.com/cybercronai/status/1918328486957023434 · Twitter Post
• https://twitter.com/CVEnew/status/1918014596297765100 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1918111571907166387 · Twitter Post