CVE-2025-46345

MEDIUM

Auth0 Account Link Extension <2.6.6 - Info Disclosure

Title source: llm
STIX 2.1

Description

Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue has been patched in versions 2.6.7, 2.7.0, and 3.0.0. It is recommended to upgrade to version 3.0.0 or greater.

References (2)

Core 2

Scores

CVSS v4 6.9
EPSS 0.0032
EPSS Percentile 23.2%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-290
Status published
Products (1)
auth0-extensions/auth0-account-link-extension >= 2.3.4, < 2.6.7
Published May 01, 2025
Tracked Since Feb 18, 2026