CVE-2025-59934

Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.

• CWE-287
• CWE-345
• CWE-347

• https://github.com/formbricks/formbricks/blob/843110b0d6c37b5c0da54291616f84c91c55c4fc/apps/web/lib/jwt.ts#L114-L117
• https://github.com/formbricks/formbricks/commit/eb1349f205189d5b2d4a95ec42245ca98cf68c82
• https://github.com/formbricks/formbricks/pull/6596
• https://github.com/formbricks/formbricks/security/advisories/GHSA-7229-q9pv-j6p4

Published

Sep 26, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59928Rejected reason: Not used
• CVE-2025-59929Rejected reason: Not used
• CVE-2025-5993ITCube CRM in versions from 2023.2 through 2025.2 is vulnera…9.2
• CVE-2025-59930Rejected reason: Not used
• CVE-2025-59932Flag Forge is a Capture The Flag (CTF) platform. From versio…8.2
• CVE-2025-59933libvips is a demand-driven, horizontally threaded image proc…7.8
• CVE-2025-59935GLPI is a free asset and IT management software package. Sta…6.5
• CVE-2025-59936get-jwks contains fetch utils for JWKS keys. In versions pri…9.4
• CVE-2025-59937go-mail is a comprehensive library for sending mails with Go…9.1
• CVE-2025-59938Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2025-59939WeGIA is a Web manager for charitable institutions. Prior to…8.8
• CVE-2025-5994A multi-vendor cache poisoning vulnerability named 'Rebirthd…8.7