CVE-2025-59934: Critical Flaw in Formbricks Allows Unauthorized Password Resets via Forged JWT Tokens

CVE-2025-59934 is a critical authentication flaw in Formbricks that allows attackers to bypass JWT verification and reset user passwords without authorization. The vulnerability arises from a token validation routine that only decodes JWTs (jwt[.]decode) without verifying signatures, expiry, issuer or audience, according to the advisory.

An attacker who learns a victim’s user[.]id could forge a JWT with an alg: “none” and authenticate as the victim or reset their password, the advisory explains, and a working PoC describes submitting a forged token to the forgot-password reset endpoint to trigger a password change. The flaw has a CVSS score of 9.4 (Critical), and Formbricks has released a patch; users should upgrade to version 4.0.1 or later.

Until patched, organisations are advised to restrict access to password reset endpoints, monitor for unusual reset requests and rotate credentials if compromise is suspected.