CVE-2025-59934

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59934
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59934.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59934
Aliases
  • GHSA-7229-q9pv-j6p4
Published
2025-09-26T23:03:30.995Z
Modified
2026-04-10T05:33:41.602747Z
Severity
  • 9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Formbricks missing JWT signature verification
Details

Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59934.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287",
        "CWE-345",
        "CWE-347"
    ]
}
References

Affected packages

Git / github.com/formbricks/formbricks

Affected ranges

Type
GIT
Repo
https://github.com/formbricks/formbricks
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d49517be91fae7214fd521a3673be00ca127cc75

Affected versions

4.*
4.0.0
4.0.0-rc.1
4.0.0-rc.2
@formbricks/api@1.*
@formbricks/api@1.0.0
@formbricks/api@1.1.0
@formbricks/js@1.*
@formbricks/js@1.0.0
@formbricks/js@1.0.1
@formbricks/js@1.0.2
@formbricks/js@1.0.3
@formbricks/js@1.0.4
@formbricks/js@1.0.5
@formbricks/js@1.0.6
@formbricks/js@1.1.0
@formbricks/js@1.1.3
@formbricks/js@1.1.4
@formbricks/js@1.2.0
@formbricks/js@1.2.1
@formbricks/js@1.2.2
@formbricks/js@1.2.3
@formbricks/js@1.2.4
@formbricks/js@1.2.5
@formbricks/js@1.2.6
@formbricks/js@1.2.7
@formbricks/react@0.*
@formbricks/react@0.0.3
@formbricks/react@0.2.0
@formbricks/surveys@1.*
@formbricks/surveys@1.0.1
v0.*
v0.1.0
v0.10
v0.11
v0.12
v0.13
v0.14
v0.15
v0.2.0
v0.3.0
v0.4.0
v0.8
v1.*
v1.0
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.2
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.2
v2.4.3
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.6.0
v2.7.0
v2.7.1
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.12.0
v3.13.0
v3.13.1
v3.14.0
v3.17.0-rc.1
v3.2.0
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.6.2
v3.7.0
v3.7.1
v3.8.0
v3.8.1
v3.8.2
v3.8.3
v3.8.4
v3.8.5
v3.8.6
v3.8.7
v3.9.0
v3.9.1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59934.json"