BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-22

Assigner: CERT.PL

Description

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-22

Generated

2026-07-07

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-3930

Affected Vendors & Products

Vendor	Product	Version / Range
strapi	strapi	<5.20.0
strapi	strapi	<5.10.3
strapi	strapi	4.25.2
strapi	strapi	>5.0.0,<5.5.2
strapi	strapi	5.24.2
strapi	strapi	<4.25.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability occurs because Strapi uses JSON Web Tokens (JWT) for authentication, but after a user logs out or deactivates their account, the JWT is not invalidated. This means an attacker who has stolen or intercepted the token can continue to use it until it expires (default 30 days). Additionally, the /admin/renew-token endpoint allows anyone to renew tokens that are near expiration indefinitely, increasing the risk and impact of unauthorized access.

Impact Analysis

The vulnerability allows an attacker who has obtained a JWT to maintain unauthorized access to the system for an extended period, potentially up to 30 days or longer if the token is renewed via the /admin/renew-token endpoint. This can lead to unauthorized actions, data exposure, or other malicious activities within the affected Strapi application.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Strapi to version 5.24.1 or later, where the issue has been fixed. Additionally, consider reducing the JWT expiration time from the default 30 days to a shorter period to limit token reuse. Monitoring and invalidating tokens after logout or account deactivation can also help reduce risk.

Hi! I’m here to help you understand CVE-2025-3930. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70