Help with our Signup/Register flow and big security flaws

nik.baleca
Mon, 02 Feb 2026 18:43:13 +0000

I see.

Does the password change link work if you unbind the PostChallenge action by any chance?

Also, if you copy the URL sent in the email and paste it, does it contain the client_id parameter?

If you can send me a DM with the tenant name, I will take a look at your configuration.

Kind Regards,
Nik