Help with our Signup/Register flow and big security flaws

jharrison
Wed, 21 Jan 2026 17:54:56 +0000

Have inherited an auth0 sign up flow that needs attention for a new client facing application. Users are created internally and sent to Auth0 via the API.

Our full flow looks like so:

1. A User is created in internal system with an Id, email and phone number

2. This user is created in Auth0 via the IManagamentAPIClient c# like so managementApi.Users.CreateAsync(clientRequest);
It is created with a default password…. ( not user set )

3. Once the user is created we then use the IAuthenciationApiClient to send a password reset email like so… This acts as the entry point into our system in the absense of a Register or Welcome email since the user is created in step 2.
await authenticationApi.ChangePasswordAsync(new() { Connection = auth0Settings.Value.Connection, Email = user.Email });

1. The change password ( Link ) email template is used here and we change the wording to make it look somewhat a welcome email ( using some metadata properties set )

4. This email link has an expiry of a few days meaning if a user clicks on this link in the email after 2 days they are presented with a ‘Expired Link’ dialog.

5. THE ISSUE is that at this point the user is able to navigate to the normal login screen and select ‘Forgot Password’ and essentially sign up without going through the email link at all. This basically means the expired link in the email is completely pointless and giving us no layer of security other than a dialog saying its expired.

So, a few questions…

How might we tweak our flow so that an expired ‘Sign up’ or ‘Register’ link completely blocks a user from logging in?

Are we creating an anti-pattern creating the users upfront and then sending them a reset password email as the initial email?

Happy to give more information if required but this is as concise I can be as of now.