Help with our Signup/Register flow and big security flaws

nik.baleca
Fri, 23 Jan 2026 17:46:43 +0000

Hi again @nahmadi

Did you generate a password change ticket with a client_id parameter included in the body? This error is not caused by the logic inside your Action, but rather by the existence of an Action in the flow combined with a missing parameter in your Ticket generation.

Also, it is important to mention that in my previous message regarding the PostChallenge action example, I had a complete oversight of the fact that you can either DENY access or REDIRECT the user.

I would suggest to redirect the user straight away since they will not reach the password reset screen anyways or you can customize the error screen inside Universal Login to inform the user of the reason they were denied access.

Kind Regards,
Nik