CVE-2025-59934 (CVSS 9.4): Critical Authentication Flaw in Formbricks Allows Unauthorized Password Resets

Estimated reading time: 7 minutes

Key takeaways:

  • A critical vulnerability, CVE-2025-59934, has been identified in Formbricks, allowing for unauthorized password resets.
  • The vulnerability stems from improper JWT validation, using jwt.decode instead of jwt.verify.
  • Exploitation can lead to full account takeover by attackers.
  • Immediate mitigation steps include upgrading to Formbricks version 4.0.1 or later.
  • PurpleOps services can assist in identifying and mitigating such vulnerabilities.

Table of contents:

  1. Understanding CVE-2025-59934: JWT Validation Vulnerability in Formbricks
  2. Technical Breakdown of the Vulnerability
  3. Impact of the Vulnerability
  4. Practical Takeaways and Mitigation Strategies
  5. Technical Mitigation Steps
  6. Non-Technical Considerations
  7. Relevance to PurpleOps Services and Expertise
  8. Conclusion
  9. FAQ

Understanding CVE-2025-59934: JWT Validation Vulnerability in Formbricks

A critical vulnerability, identified as CVE-2025-59934 with a CVSS score of 9.4, has been discovered in Formbricks, an open-source platform designed for building in-app and website surveys. This flaw allows attackers to bypass JSON Web Token (JWT) verification, leading to unauthorized password resets and potential account takeover. This blog post will detail the vulnerability, its implications, and necessary steps for mitigation.

The core issue lies in how Formbricks validates JWTs. The system uses jwt.decode instead of jwt.verify, meaning it decodes the JWT without verifying its signature, expiration, issuer, or audience. This omission allows an attacker to forge a JWT and use it to reset a user’s password, provided they know the user’s ID.

According to the security advisory, the email verification token login path and the password reset server action both rely on this flawed validator. This widespread use of the vulnerable validation routine significantly amplifies the risk.

Technical Breakdown of the Vulnerability

The vulnerability allows for the creation of a malicious JWT with an "alg": "none" header. This crafted token can then be submitted through the /auth/forgot-password/reset?token=<forged_JWT> endpoint. Because the server doesn’t verify the token’s signature, it accepts the forged token, queries the database for the user ID specified in the token, and proceeds to reset the password.

A proof-of-concept (PoC) for exploiting this vulnerability involves the following steps:

  1. Obtain the victim’s user.id.
  2. Craft a JWT with the payload {"id": "<victim_user.id>"} and the header alg: "none".
  3. Submit this forged JWT via the /auth/forgot-password/reset?token=<forged_JWT> endpoint.

This process circumvents all security measures intended to protect user accounts, granting the attacker complete control.

Impact of the Vulnerability

Successful exploitation of CVE-2025-59934 leads to full account takeover. By resetting a user’s password, an attacker can lock the legitimate user out of their account and gain unauthorized access to sensitive information or functionalities. The advisory explicitly warns that knowing the victim’s user.id is enough to arbitrarily change their password.

This is especially concerning given that Formbricks exposes both the email verification and password reset flows to this vulnerability, creating multiple attack vectors.

Practical Takeaways and Mitigation Strategies

Addressing this critical flaw requires immediate action. Here’s a breakdown of steps for both technical and non-technical stakeholders:

Technical Mitigation Steps

  1. Immediate Upgrade: The most effective solution is to upgrade Formbricks to version 4.0.1 or later. This version includes the necessary patch to correct the JWT validation logic.
  2. Temporary Mitigation (If Upgrade Is Not Immediately Possible):

    • Restrict access to password reset endpoints to trusted IP addresses or internal networks.
    • Implement rate limiting on password reset requests to slow down potential brute-force attacks.
    • Manually review and validate password reset requests.
  3. Code Review: Conduct a thorough code review of the authentication and authorization mechanisms within your Formbricks implementation to identify any similar vulnerabilities.
  4. Implement Proper JWT Validation: Ensure that all JWTs are validated using jwt.verify to check their signatures, expiration, issuer, and audience.
  5. Monitor Logs: Implement robust logging and monitoring to detect suspicious activity, such as unusual password reset requests or attempts to access restricted endpoints. This can aid in breach detection and incident response.

Non-Technical Considerations

  1. Communicate with Users: Inform users about the vulnerability and advise them to be cautious of suspicious password reset requests.
  2. Review Security Policies: Update your organization’s security policies to reflect the risks associated with JWT vulnerabilities and the importance of proper validation.
  3. Incident Response Plan: Ensure that your incident response plan includes procedures for handling account takeover incidents resulting from exploited vulnerabilities.
  4. Regular Security Audits: Conduct regular security audits and penetration testing to identify and address vulnerabilities before they can be exploited. Supply-chain risk monitoring is also crucial, as vulnerabilities in third-party components can impact your overall security posture.

Relevance to PurpleOps Services and Expertise

PurpleOps provides a range of services that can help organizations mitigate the risks associated with vulnerabilities like CVE-2025-59934. Our expertise in cyber threat intelligence platform, real-time ransomware intelligence, and dark web monitoring service can help identify potential threats and vulnerabilities before they are exploited.

Specifically, the following PurpleOps services are relevant to this vulnerability:

  • Penetration Testing: PurpleOps’s penetration testing services can identify vulnerabilities in your Formbricks implementation, including those related to authentication and authorization.
  • Red Team Operations: Our red team operations simulate real-world attacks to assess your organization’s security posture and identify weaknesses in your defenses.
  • Supply Chain Information Security: PurpleOps can help you assess the security risks associated with third-party components like Formbricks and implement measures to mitigate those risks.
  • Breach Detection: PurpleOps’s Breach Detection services can assist you in detecting a potential intrusion from the attacker by monitoring network activity and system logs.
  • Underground Forum Intelligence: Our underground forum intelligence gathering monitors threat actors discussing potential exploits of vulnerabilities, including those affecting Formbricks.
  • Brand Leak Alerting: Our brand leak alerting service can detect if user IDs or other sensitive information related to your Formbricks deployment are leaked on the dark web or other online sources, potentially indicating a compromise.
  • Telegram Threat Monitoring: PurpleOps can also monitor Telegram channels for discussions and sharing of exploits related to the vulnerability, providing timely real-time ransomware intelligence.

By leveraging these services, organizations can proactively identify and address vulnerabilities, strengthen their security posture, and protect themselves from potential attacks.

Conclusion

The CVE-2025-59934 vulnerability in Formbricks presents a significant risk to organizations using the platform. By understanding the vulnerability, its implications, and implementing the recommended mitigation strategies, organizations can protect themselves from potential account takeover attacks. PurpleOps offers a comprehensive suite of cybersecurity services that can help organizations strengthen their security posture and mitigate the risks associated with vulnerabilities like this one.

Contact PurpleOps today to learn more about how we can help you protect your organization from cyber threats. Explore our platform at https://www.purple-ops.io/platform/ or our services at PurpleOps Solutions.

FAQ

Q: What is CVE-2025-59934?
A: CVE-2025-59934 is a critical vulnerability in Formbricks that allows attackers to bypass JWT verification, leading to unauthorized password resets and potential account takeover.

Q: What is the CVSS score for CVE-2025-59934?
A: The CVSS score for CVE-2025-59934 is 9.4, indicating a critical severity.

Q: What versions of Formbricks are affected?
A: Versions prior to 4.0.1 are affected by this vulnerability.

Q: How can I mitigate this vulnerability?
A: The most effective solution is to upgrade to Formbricks version 4.0.1 or later. Temporary mitigations include restricting access to password reset endpoints, implementing rate limiting, and manually reviewing password reset requests.

Q: How can PurpleOps help?
A: PurpleOps offers services like penetration testing, red team operations, and supply chain information security assessments to help identify and mitigate vulnerabilities like CVE-2025-59934. Our breach detection services, brand leak alerting and underground forum intelligence can provide early warnings of potential compromises.