CVE-2025-46345

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue has been patched in versions 2.6.7, 2.7.0, and 3.0.0. It is recommended to upgrade to version 3.0.0 or greater.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published: May 1, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-463465.4YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the app CVE-2025-463479.8YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be CVE-2025-463489.8YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded witho CVE-2025-463496.1YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulner CVE-2025-46356.6A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code e CVE-2025-463504.8YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookie CVE-2025-463529.8The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary respon CVE-2025-463547.5A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A spec CVE-2025-463557.0Incorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on Wi CVE-2025-463587.7Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks CVE-2025-463597.2A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary CVE-2025-46367.8Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this us