Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

Description

No description available.

Recommendation

Update the @strapi/plugin-users-permissions package to the latest compatible version. Followings are version details:

Affected version(s): <= 5.44.0
Patched version(s): 5.45.0

References

Could your website be exposed too?

SmartScanner can check your website for Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying and gives you actionable findings to investigate.

Start a free scan

Related Issues

Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions - CVE-2023-38507
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass - CVE-2024-34065
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header - CVE-2025-66482
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated May 15, 2026