Authentication Bypass in @strapi/plugin-users-permissions

Description

Strapi through 4.5.6 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.

Recommendation

Update the @strapi/plugin-users-permissions package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.2.1, < 4.6.0
• Patched version(s): 4.6.0

References

• GHSA-xv3q-jrmm-4fxv

Related Issues

• node-forge is vulnerable to ASN.1 OID Integer Truncation - CVE-2025-66030
• @perfood/couch-auth may expose session tokens, passwords - CVE-2025-60794
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass - CVE-2024-34065

Tags:

npm

@strapi/plugin-users-permissions