Formbricks Signature Verification Flaw Lets Attackers Reset User Passwords

A critical vulnerability in the open source Formbricks experience management toolbox allows attackers to reset any user’s password without authorisation, according to GHSA-7229-q9pv-j6p4. The flaw stems from missing JWT signature verification in Formbricks versions before 4.0.1, and the vulnerability enables token forgery if an attacker learns a valid user ID, potentially impacting password reset and email verification flows.

The CVE is CVE-2025-59934, with a CVSS v3.1 Base Score of 9.8, and the issue arises because the verifyToken function decodes the JWT payload via jwt[.]decode instead of jwt[.]verify. Formbricks has released version 4.0.1 to address the issue, substituting jwt[.]decode with jwt[.]verify to enforce signature, expiration, issuer, and audience checks. Users are advised to upgrade to 4.0.1 as soon as possible, with the guidance to run npm install formbricks@^4.0.1.