Help with our Signup/Register flow and big security flaws

nik.baleca
Wed, 21 Jan 2026 19:56:48 +0000

Hi @jharrison

Welcome to the Auth0 Community!

Indeed, the scenario you have presented considered an anti-pattern and if not handled, this indeed would indicate a security flaw allowing users to bypass the invitation system of your application.

My suggestion in order to prevent the users from resetting the password by themselves would be to deny access to users using a password-reset-post-challenge trigger whenever email_verified is false. Since you are creating the users, this should be by default false. The code for this would look like this:

 exports.onExecutePostChallenge = async (event, api) => {
    if(event.user.email_verified === false)
    {
//Deny access to the user
      api.access.deny("Please reset your password through the invitation link");

//Redirect to a custom error page informing the user
      api.redirect.sendUserTo("https://my-app.exampleco.com/password_reset_denied");
    }
  };

This is where the tricky part comes:

Instead of sending a password change email to the users, you will need to send a email verification email to your users

Create a password change ticket for the respective user

Inside the verification email, you will need to attach an email verification ticket which has the result_url parameter the password change ticket generated beforehand

This way, the users will be blocked to change the password via Universal Login if their account has not been verified and will be forced to reset it through the activation email you will be generating for them.

It can be quite an extended workaround, however, the initial flow you have described would be expected in order to avoid redundancy. Basically, an user who is able to change the password via an email automatically sent to them by the app should be able to ask for a password change email themselves via the Universal Login UI.

Hope the information above is helpful regarding the matter, if you have any other questions, let me know!

Kind Regards,
Nik