Formbricks Hacked: How a Signature Verification Flaw Puts Your User Passwords at Risk of Unauthorized Reset

By CyberDudeBivash • September 29, 2025, 3:56 PM IST • AppSec & Developer Security Directive

In the world of application security, some vulnerabilities are complex, while others are brutally simple. The latest critical flaw discovered in the open-source Formbricks platform falls into the second category. A catastrophic failure in how the application’s password reset function verifies JSON Web Tokens (JWTs) allows a completely unauthenticated attacker to reset the password of any user, including the primary administrator, and achieve a full application takeover. This is not a theoretical flaw; it is a classic, high-impact implementation error that underscores the dangers of relying on insecure defaults. We’re tracking this vulnerability as **CVE-2025-49119**. For any organization using Formbricks, this is an all-hands-on-deck, patch-now situation. This is your deep-dive technical breakdown of the attack and your immediate remediation playbook.

Disclosure: This is a technical security directive for developers and AppSec professionals. It contains our full suite of affiliate links to best-in-class solutions for a holistic security posture. Your support helps fund our independent research.

Executive Summary / TL;DR

For the busy CISO: A critical flaw in Formbricks allows unauthenticated attackers to reset admin passwords. The root cause is a failure to validate the signature on a password reset token (a JWT). Attackers can forge a token, set the signing algorithm to ‘none’, and the server will accept it, allowing a full account takeover. The **immediate action is to patch your Formbricks instance**. The strategic fix is to ensure your developers are trained in secure coding practices to avoid these common implementation errors and to protect all admin accounts with phishing-resistant MFA as a final backstop.

Security Directive: Table of Contents

Chapter 1: Threat Analysis – Deconstructing the JWT Signature Verification Flaw

To understand this attack, you must first understand the technology at its heart: the JSON Web Token, or JWT.

What is a JWT?

A JWT is a compact and self-contained standard for securely transmitting information between parties. It’s often used for authentication and authorization. A JWT consists of three parts, separated by dots: `HEADER.PAYLOAD.SIGNATURE`.

Header:** Contains metadata about the token, including the signing algorithm used (the `alg` field).
**Payload:** Contains the actual data, or “claims” (e.g., the user’s email, the token’s expiration date).
**Signature:** This is the critical security component. It’s a cryptographic signature created by the server using its secret key. It verifies that the token is authentic and that the payload has not been tampered with.

The Flaw Explained (CVE-2025-49119)

The JWT standard includes a special, non-secure algorithm for testing and debugging purposes: **`”alg”: “none”`**. When this is specified, it means the token has no signature at all.

The vulnerability in Formbricks is a classic implementation error. The library used to validate the password reset JWT was not configured to explicitly reject the `none` algorithm. It relied on a default setting that, dangerously, accepted it as valid.

An attacker can therefore take any valid password reset token, decode its payload, change the user’s email to `admin@company.com`, change the algorithm in the header to `none`, strip off the signature, and send this forged token back to the server. The vulnerable server sees the `alg` is `none` and completely skips the signature verification step, accepting the attacker’s tampered payload as legitimate. It is a catastrophic failure of trust.

Chapter 2: The Kill Chain – From a Single `POST` to Full Admin Takeover

The kill chain for this attack is ruthlessly simple and requires no user interaction.

Step 1: The Reconnaissance. The attacker finds your internet-facing Formbricks login page.
Step 2: The Forgery. The attacker initiates a password reset for their *own* email address to obtain a legitimate token. They copy this token and decode its contents (JWTs are Base64 encoded, not encrypted). They now have a perfect template.
Step 3: The Tampering. The attacker modifies the decoded JWT.
- In the **header**, they change `”alg”: “HS256″` (or similar) to `”alg”: “none”`.
- In the **payload**, they change the `”email”` claim from their own email to their target’s email, e.g., `admin@yourcompany.com`.
Step 4: The Attack. The attacker Base64-encodes the modified header and payload. They then take the original signature and simply delete it, leaving a trailing dot. They submit this new, forged token (`MODIFIED_HEADER.MODIFIED_PAYLOAD.`) to the password reset confirmation endpoint.
Step 5: The Takeover. The vulnerable Formbricks server accepts the forged token, resets the administrator’s password to a new one chosen by the attacker, and logs the attacker in as the administrator. The attacker now has full control.

Chapter 3: Your Emergency Remediation & Hunting Plan

This is your tactical checklist. Begin these actions now.

Step 1 (Immediate): Patch Your Formbricks Instance

The only permanent fix is to apply the security update. The Formbricks developers have released a patched version that explicitly configures the JWT validation library to require a secure algorithm and reject `none`.

**Action:** Follow the official documentation for your deployment type to upgrade to the latest secure version immediately. This must be your highest priority.

Step 2 (Urgent): Hunt for Compromise

Assume you were targeted before you patched. Your SOC and admin teams need to hunt for these IoCs:

Analyze Web Server Logs:** Scour your web server access logs for `POST` requests to the password reset confirmation endpoint. Look for JWTs in these requests that have a missing or empty signature (i.e., they end in a `.` with nothing after it). This is a high-confidence IoC.
Audit Application Logs:** In the Formbricks admin UI, check the audit trail for any unexpected password changes or logins for your administrator accounts, especially if they correlate with an IP address you don’t recognize.

CyberDudeBivash’s Recommended Hunting Stack:

To effectively hunt for post-exploitation activity, you need deep visibility. A powerful, behavior-focused EDR platform like **Kaspersky EDR** is your essential tool. If an attacker compromises your Formbricks server, the EDR can detect their next move, such as the application process spawning a shell or attempting to scan the internal network.

[Need help conducting a compromise assessment? Contact our incident response experts.]

Chapter 4: Strategic Hardening – A Developer’s Guide to Secure Authentication

This incident is a powerful lesson for all developers on the dangers of insecure defaults.

1. Always Explicitly Configure Your Libraries

Never trust the default settings of a security library. When using a JWT library, you must **always** provide an explicit list of the secure algorithms you will accept (e.g., `HS256`, `RS256`). Never allow the library to trust the `alg` header sent by the client.

2. Implement a Layered Defense for Authentication

The Core Technical Toolkit

A layered defense is required to protect your critical applications.

The WAF Layer (Alibaba Cloud):** A **WAF** can provide a powerful virtual patch by creating a rule to inspect and block any JWT that contains `”alg”:”none”`.
The Identity Layer (YubiKeys):** The ultimate defense. Even if an attacker successfully resets a password, if the account is protected by phishing-resistant MFA using a hardware key like a **YubiKey**, they will be blocked at the login page.

3. Invest in Secure Coding Knowledge

The Modern Professional’s Toolkit

Building secure applications requires a commitment to continuous learning.

The Skills (Edureka):** The best way to prevent these flaws is to never write them. Your developers must be trained on the OWASP Top 10 and secure coding practices. A certified **Application Security program from Edureka** is a critical investment.
Secure Connections (TurboVPN):** Ensure your developers are using a **VPN** when accessing your code repositories and servers remotely.
Global Career Skills (YES Education Group):** Strong **English skills** are essential for reading technical documentation and collaborating with the global open-source community.

Financial & Lifestyle Resilience (A Note for Our Readers in India)

As a developer or tech professional, securing your personal finances is just as important as securing your code.

Secure Digital Banking (Tata Neu):** Manage your UPI payments, shopping, and bills through a secure, unified platform like the **Tata Neu Super App**, and use a dedicated card like the **Tata Neu Credit Card**.
Premier Banking Security (HSBC):** For senior professionals, ensure your banking partner, like **HSBC Premier**, offers the robust security your assets require.
For Entrepreneurs (Rewardful): If you’re building the next great developer tool, a platform like **Rewardful** can help you launch a powerful affiliate program.

Chapter 5: Extended FAQ on JWT Security

Q: What is the OWASP category for this type of vulnerability?
A: This is a classic example of **A01:2021 – Broken Access Control**, as it allows an attacker to bypass the password reset mechanism. It also falls under **A07:2021 – Identification and Authentication Failures**, specifically related to the failure to validate cryptographic signatures.

Q: Are all JWTs insecure? Should I stop using them?
A: No. JWTs are a powerful and secure standard *when implemented correctly*. The problem is not the standard itself, but the common implementation mistakes. A properly configured JWT validation library that rejects weak algorithms and enforces strong signatures is a perfectly secure mechanism for authentication.

About the Author

CyberDudeBivash is a cybersecurity strategist and researcher with over 15 years of experience in threat intelligence, application security, and incident response. He provides strategic advisory services to CISOs and boards across the APAC region. [Last Updated: September 29, 2025]

#CyberDudeBivash #Formbricks #CVE #AppSec #DevSecOps #WebAppSec #OWASP #CyberSecurity #PatchNow #ThreatIntel #JWT

Cyberdudebivash