CVE-2025-3930
BaseFortify
Publication date: 2025-10-16
Last updated on: 2025-10-22
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| strapi | strapi | <5.20.0 |
| strapi | strapi | <5.10.3 |
| strapi | strapi | 4.25.2 |
| strapi | strapi | >5.0.0,<5.5.2 |
| strapi | strapi | 5.24.2 |
| strapi | strapi | <4.25.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because Strapi uses JSON Web Tokens (JWT) for authentication, but after a user logs out or deactivates their account, the JWT is not invalidated. This means an attacker who has stolen or intercepted the token can continue to use it until it expires (default 30 days). Additionally, the /admin/renew-token endpoint allows anyone to renew tokens that are near expiration indefinitely, increasing the risk and impact of unauthorized access.
How can this vulnerability impact me? :
The vulnerability allows an attacker who has obtained a JWT to maintain unauthorized access to the system for an extended period, potentially up to 30 days or longer if the token is renewed via the /admin/renew-token endpoint. This can lead to unauthorized actions, data exposure, or other malicious activities within the affected Strapi application.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Strapi to version 5.24.1 or later, where the issue has been fixed. Additionally, consider reducing the JWT expiration time from the default 30 days to a shorter period to limit token reuse. Monitoring and invalidating tokens after logout or account deactivation can also help reduce risk.