CVE-2025-46345: Auth0 Account Link Auth Bypass Flaw

CVE-2025-46345 Overview

CVE-2025-46345 is an authentication bypass vulnerability in the Auth0 Account Link Extension. The extension helps users link multiple identity accounts together within Auth0 tenants. Versions 2.3.4 through 2.6.6 fail to verify the cryptographic signature of JSON Web Tokens (JWT) provided to the extension. An attacker can forge a JWT and submit it to the extension to gain access to user information without proper authorization. The issue is classified under [CWE-290: Authentication Bypass by Spoofing]. Auth0 patched the flaw in versions 2.6.7, 2.7.0, and 3.0.0.

Critical Impact
Unauthenticated network attackers can forge JWTs to access linked user account information without valid credentials.

Affected Products

Auth0 Account Link Extension 2.3.4 through 2.6.6
Auth0 tenants deploying the vulnerable extension for account linking
Downstream applications relying on the extension for identity federation

Discovery Timeline

2025-05-01 - CVE-2025-46345 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46345

Vulnerability Analysis

The Auth0 Account Link Extension accepts JSON Web Tokens to authorize account linking operations between user identities. In vulnerable releases, the extension decodes the JWT payload without validating the token signature. This means the server trusts the claims embedded in the token regardless of whether the token was signed by a legitimate issuer.

An attacker can craft a token containing arbitrary user identifiers and submit it to the extension. Because signature validation is absent, the extension processes the forged claims as authentic. The result is unauthorized disclosure of user information tied to the target account.

The flaw maps to [CWE-290: Authentication Bypass by Spoofing]. Exploitation requires no privileges, no user interaction, and can be performed over the network against exposed extension endpoints.

Root Cause

The root cause is missing signature verification during JWT processing. Secure JWT libraries provide functions such as jwt.verify() that validate the token against a signing key, but the extension used a decode-only path that parses claims without cryptographic validation. This design bypasses the integrity guarantees that JWTs are intended to provide.

Attack Vector

An attacker constructs a JWT with a forged payload identifying an arbitrary user or session context. The token can use any signature or the none algorithm because the extension does not validate the signature at all. The attacker submits the forged token to the extension endpoint over HTTPS. The extension parses the token, extracts the claims, and performs account linking or information retrieval based on the attacker-controlled payload. Full technical details are available in the GitHub Security Advisory GHSA-j2jh-rqff-7vmg.

Detection Methods for CVE-2025-46345

Indicators of Compromise

Requests to Auth0 Account Link Extension endpoints containing JWTs with alg: none or unexpected signing algorithms
Account link events referencing user identifiers that were not part of a legitimate login flow
Unusual spikes in linking activity from single source IP addresses or automated user agents
Access to user profile data immediately following an unlinked or unauthenticated request

Detection Strategies

Inspect JWTs received by the extension and log the alg header, iss, and sub claims for offline analysis
Compare token issuers against the approved Auth0 tenant signing keys and alert on mismatches
Correlate account link operations with preceding authentication events in Auth0 tenant logs
Deploy web application firewall rules that reject tokens using none or mismatched signing algorithms

Monitoring Recommendations

Enable Auth0 tenant log streaming for sapi and slo events and forward to a centralized SIEM
Track version metadata of deployed Auth0 extensions and alert when versions below 2.6.7 are detected
Baseline normal account linking volume and rate-limit or flag anomalies

How to Mitigate CVE-2025-46345

Immediate Actions Required

Upgrade the Auth0 Account Link Extension to version 3.0.0 or later immediately
Audit recent account link events for suspicious activity that occurred while running vulnerable versions
Rotate any credentials or session tokens associated with accounts that show unexplained link operations
Restrict network exposure of the extension to known administrative sources where feasible

Patch Information

Auth0 released fixes in versions 2.6.7, 2.7.0, and 3.0.0. Version 3.0.0 or greater is the recommended upgrade target. The fix adds JWT signature verification against the tenant signing key. See the GitHub Pull Request 187 for the code change details.

Workarounds

Disable the Account Link Extension until the upgrade is applied if immediate patching is not feasible
Place the extension behind a reverse proxy that validates JWT signatures before requests reach the extension
Restrict extension access to internal networks or trusted IP ranges through Auth0 tenant configuration

bash

# Verify installed extension version in an Auth0 tenant
curl -H "Authorization: Bearer $MGMT_API_TOKEN" \
  https://YOUR_TENANT.auth0.com/api/v2/extensions \
  | jq '.[] | select(.name=="auth0-account-link-extension") | {name, version}'

# Expected output for a patched deployment:
# { "name": "auth0-account-link-extension", "version": "3.0.0" }