Loading story…
A critical security vulnerability, tracked as CVE-2025-59934, was discovered in Formbricks, an open-source alternative to Qualtrics. The flaw arises from the absence of proper JWT (JSON Web Token) signature verification in the application’s authentication and password reset mechanisms. Specifically, the token validation routine in Formbricks prior to version 4.0.1 only decodes JWTs without verifying their signatures, expiration, issuer, or audience. This oversight allows attackers to craft arbitrary JWTs with an 'alg: none' header, bypassing signature checks entirely. If an attacker is able to obtain a victim’s user ID, they can generate a forged JWT and use it to authenticate as the victim or reset their password without authorization. Both the email verification token login path and the password reset server action are affected by this vulnerability, as they share the same flawed validator. The vulnerability is remotely exploitable, significantly increasing the risk to organizations using affected versions of Formbricks. The issue has been assigned a CVSS 3.1 score of 9.4, indicating its critical severity. Security researchers and advisories have confirmed that the vulnerability can be exploited without any prior authentication, making it a prime target for attackers. The flaw was addressed and patched in Formbricks version 4.0.1, and users are strongly advised to upgrade immediately to mitigate the risk. The vulnerability was publicly disclosed on September 26, 2025, and quickly gained attention due to its potential impact on user accounts and sensitive data. Exploitation of this flaw could lead to unauthorized access, account takeover, and potential data breaches. The vulnerability affects all versions of Formbricks prior to 4.0.1, and there is no indication that earlier versions perform any additional checks to mitigate the risk. The security community has emphasized the importance of proper JWT signature verification as a fundamental security practice. Organizations using Formbricks should review their authentication logs for signs of suspicious activity and reset credentials as a precaution. The vulnerability highlights the dangers of improper implementation of authentication protocols in open-source software. Security advisories have been issued to raise awareness and provide guidance on remediation steps. The incident underscores the need for regular security reviews and prompt patching of critical vulnerabilities in widely used applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A critical vulnerability, CVE-2025-59934, was publicly disclosed affecting Formbricks. The flaw involves missing JWT signature verification, which can allow forged tokens and unauthorized password resets.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026
A critical vulnerability in **Postiz** allows any authenticated user to escalate privileges to **SUPERADMIN** by forging JWTs through the application's **Skool integration callback**. Tracked as **`CVE-2026-48781`** and **`GHSA-j77w-h625-56q2`**, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's `JWT_SECRET`, while authentication logic trusted the token's claims without reloading the user record from the database. The bug affects Postiz versions prior to **`2.21.8`** and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated **CVSS 9.9 (Critical)**, was verified and patched by the vendor, and defenders are advised to upgrade to **`2.21.8`**, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
Jul 12, 2026
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Jul 1, 2026