CVE-2025-46345

Description

Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue has been patched in versions 2.6.7, 2.7.0, and 3.0.0. It is recommended to upgrade to version 3.0.0 or greater.

Reserved 2025-04-22 | Published 2025-05-01 | Updated 2025-05-02 | Assigner GitHub_M

Problem types

CWE-290: Authentication Bypass by Spoofing

Product status

>= 2.3.4, < 2.6.7
affected

References

github.com/...ension/security/advisories/GHSA-j2jh-rqff-7vmg

github.com/...tensions/auth0-account-link-extension/pull/187

cve.org (CVE-2025-46345)

nvd.nist.gov (CVE-2025-46345)

Download JSON