CVE Feed

    Dashboard / CVE / CVE-2025-3930

    CVE-2025-3930

    Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

    Published:Oct 16, 2025
    Last Modified:Apr 15, 2026
    EPS:Oct 16, 2025
    EPSS Score:0.00076
    CVSS Score:6.3

    Affected Products

    Vendor
    Strapi
    Product
    Strapi

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-613 Insufficient Session Expiration

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-57997 (CVSS 6.3) — Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm …
    CVE-2026-27886 (CVSS 9.2) — Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.…
    CVE-2026-22707 (CVSS 5.3) — Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload pl…
    CVE-2026-22706 (CVSS 2.1) — Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or r…
    CVE-2026-22599 (CVSS 9.3) — Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and…
    CVE-2025-64526 (CVSS 6.9) — Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limi…
    CVE-2025-53092 (CVSS 6.5) — Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS mi…
    CVE-2025-25298 (CVSS 6.3) — Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maxim…
    CVE-2024-56143 (CVSS 8.2) — Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the looku…
    CVE-2024-52588 (CVSS 4.9) — Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High