Help with our Signup/Register flow and big security flaws

nik.baleca
Wed, 28 Jan 2026 17:08:02 +0000

Hi again!

As far as I have checked, the specified error would be triggered only when using the “Test” button available under an email template within the Auth0 Dashboard. This happens because the “Test” button does not have a default Client ID and the error is expected. Also, this error can be encountered when trying to generate a change pw ticket without a Client ID passed inside the body of the request.

Otherwise, when testing with the Login Box option or with an /authorize call the behaviour was normal and I could not reproduce the mentioned error.

Can you confirm that this behaviour happens during a normal /authorize call or the Login Box option without triggering the endpoint for the pw change ticket?

Kind Regards,
Nik