Vulnerability · Published May 1, 2025 · Assigned by GitHub_M

CVE-2025-46345Auth0 Account Link Extension JWT Invalid Signature Validation

Medium 6.9

In plain English

A medium-severity authentication bypass by spoofing in auth0-account-link-extension from auth0-extensions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue has been patched in versions 2.6.7, 2.7.0, and 3.0.0. It is recommended to upgrade to version 3.0.0 or greater.

Affected products (as reported)

Vendor	Product	Versions
auth0-extensions	auth0-account-link-extension	>= 2.3.4, < 2.6.7

Weakness: CWE-290 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/auth0-extensions/auth0-account-link-extension/security/advisories/GHSA-j2jh-rqff-7vmg x_refsource_CONFIRM
https://github.com/auth0-extensions/auth0-account-link-extension/pull/187 x_refsource_MISC