Description
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed).
Recommendation
Update the @strapi/strapi package to the latest compatible version. Followings are version details:
- Affected version(s): < 5.24.1
- Patched version(s): 5.24.1
References
Related Issues
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
- Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
- Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
- Turbo Frame responses can restore stale session cookies - CVE-2025-66803
You might also like:
- Tags:
- npm
- @strapi/strapi
Anything's wrong? Let us know Last updated on October 22, 2025