AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaOKTA-0D6JW07

JWT Invalid Signature Validation in Auth0 Account Linking Extensions

Okta

CVE-2025-46345 · Published Apr 30, 2025

Medium6.9
No fix yet
Okta advisory

Auth0 Account Linking Extensions versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. Upgrade to the latest version 3.0.0 or greater.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 13Severity: Unrated to Medium
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
NVD

More Okta advisories

All Okta
Medium 6.8Jul 22, 2025Okta On-Premises Provisioning (OPP) Password Reset Information DisclosureCVE-2025-7371no fix yetCritical 9.3Jun 3, 2025Deserialization of Untrusted Data in Auth0-PHP SDKCVE-2025-48951no fix yetHigh 7.7Jun 3, 2025CDN Caching of Session Cookies in NextJS-Auth0 SDKCVE-2025-48947no fix yetCritical 9.1May 15, 2025Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDKCVE-2025-47275no fix yetCritical 9.3May 6, 2025SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-FedCVE-2025-46572no fix yetHigh 8.6May 6, 2025SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-FedCVE-2025-46573no fix yet