CVE-2025-3930
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-22

Assigner: CERT.PL

Description
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-16
Last Modified
2025-10-22
Generated
2026-06-16
AI Q&A
2025-10-16
EPSS Evaluated
2026-06-15
NVD
CVE-2025-3930
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
strapi strapi <5.20.0
strapi strapi <5.10.3
strapi strapi 4.25.2
strapi strapi >5.0.0,<5.5.2
strapi strapi 5.24.2
strapi strapi <4.25.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs because Strapi uses JSON Web Tokens (JWT) for authentication, but after a user logs out or deactivates their account, the JWT is not invalidated. This means an attacker who has stolen or intercepted the token can continue to use it until it expires (default 30 days). Additionally, the /admin/renew-token endpoint allows anyone to renew tokens that are near expiration indefinitely, increasing the risk and impact of unauthorized access.

Impact Analysis

The vulnerability allows an attacker who has obtained a JWT to maintain unauthorized access to the system for an extended period, potentially up to 30 days or longer if the token is renewed via the /admin/renew-token endpoint. This can lead to unauthorized actions, data exposure, or other malicious activities within the affected Strapi application.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Strapi to version 5.24.1 or later, where the issue has been fixed. Additionally, consider reducing the JWT expiration time from the default 30 days to a shorter period to limit token reuse. Monitoring and invalidating tokens after logout or account deactivation can also help reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-3930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart