GitHub Advisoryadvisory · npm

GHSA-4r8w-3jww-m2rp Strapi is vulnerable to Insufficient Session Expiration

MEDIUM Published 2025-10-16 Modified 2025-10-22 Official page ↗
Aliases
CVE-2025-3930
Ecosystem
npm
Packages
@strapi/strapi
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-613
Reviewed
2025-10-16

Affected packages

• npm @strapi/strapi: < 5.24.1 → fixed in 5.24.1

Description

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2025-3930 Strapi uses JSON Web Tokens (JWT) for authentication. vulnerability

References