Description
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed).
Recommendation
Update the @strapi/strapi package to the latest compatible version. Followings are version details:
- Affected version(s): < 5.24.1
- Patched version(s): 5.24.1
References
Could your website be exposed too?
SmartScanner can check your website for Strapi is vulnerable to Insufficient Session Expiration and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
- Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
- Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
- Turbo Frame responses can restore stale session cookies - CVE-2025-66803
You might also like:
See something that needs correcting? Let us knowUpdated October 22, 2025