Overview
Auth0 Account Linking Extensions versions v2.3.4 to v2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization.
Am I Affected?
You are affected if you are using Auth0 Account Linking Extension versions v2.3.4 to v2.6.6.
Fix
Upgrade to the latest version v3.0.0 or greater.
References
For more information, see Auth0 Account Linking Rules Resolution and/or Auth0 Account Linking Actions Resolution.
Acknowledgments
Okta would like to thank Nykros (1nykros.a@gmail.com) for discovering this vulnerability.
Overview
Auth0 Account Linking Extensions versions
v2.3.4tov2.6.6do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization.Am I Affected?
You are affected if you are using Auth0 Account Linking Extension versions
v2.3.4tov2.6.6.Fix
Upgrade to the latest version
v3.0.0or greater.References
For more information, see Auth0 Account Linking Rules Resolution and/or Auth0 Account Linking Actions Resolution.
Acknowledgments
Okta would like to thank Nykros (1nykros.a@gmail.com) for discovering this vulnerability.