Help with our Signup/Register flow and big security flaws

nahmadi
Tue, 03 Feb 2026 10:08:28 +0000

nik.baleca:

Does the password change link work if you unbind the PostChallenge action by any chance?

Yes it works, because the PostChallenge action is removed.

nik.baleca:

Also, if you copy the URL sent in the email and paste it, does it contain the client_id parameter?

I have checked and don’t see it.

Sure DMing you. Thanks