Invalidate password change ticket after user was blocked

Get Help
,
1

Hello,

I sent a password change ticket to a user and blocked this user before they used the ticket. However, the ticket is still valid and user can change their password.

While the user will be prevented from logging in afterward, permitting them to perform any actions — especially sensitive operations such as changing their password — after being blocked is undesirable.

Are there any ways to invalidate password change ticket after user was blocked?

3

Hi @lyic

Thank you for reaching out to us!

I understand that after sending a password change ticket to a user and blocking them, they are still able to use the ticket and change their password.

The easiest way to invalidate the password change ticket is by generating a new password change ticket for the user and intentionally not sharing it with them. In Auth0, only one password change ticket can be active at a time and generating a new ticket automatically overrides and invalidates any previously issued links for that user.

How to Invalidate the Ticket

To apply this workaround, use the Auth0 Management API to create a “dummy” ticket:

  1. Make a POST request to the Management API endpoint: /api/v2/tickets/password-change.

  2. Include the blocked user’s ID or email in the request payload.

  3. Discard the URL returned in the response (do not send it to the user).

I can warmly recommend out Knowledge Article on Invalidating Password Reset Links After Password Change

Why this is necessary

When you apply a tenant block to a user (setting blocked: true), it successfully stops them from logging in, but it does not natively void existing password reset links. Additionally, Auth0’s Universal Login does not currently support disabling the “Forgot Password” flow conditionally for blocked users, as the feature is an all-or-nothing setting.

Recommended Action: If you have an automated workflow or administrative script for blocking users, add a step that immediately calls the /api/v2/tickets/password-change endpoint right after the block is applied. This automatically secures the account from unwanted modifications via lingering tickets.

Hope this helped!
Gerald