Help with our Signup/Register flow and big security flaws

nahmadi
Mon, 26 Jan 2026 15:15:56 +0000

nik.baleca:

Did you generate a password change ticket with a client_id parameter included in the body?

Hi @nik.baleca,

So, we are not calling the password change ticket from our service. i.e. we’re not using the management api.

We simply click on the link sent in the email (Change Password (Link)) from Auth0.