Strapi is vulnerable to Insufficient Session Expiration

Description

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed).

Recommendation

Update the @strapi/strapi package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.24.1
• Patched version(s): 5.24.1

References

• GHSA-4r8w-3jww-m2rp
• strapi.io
• cert.pl
• CVE-2025-3930
• CWE-613
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies - CVE-2025-48947
• Apostrophe CMS Insufficient Session Expiration vulnerability - CVE-2021-25979
• Strapi core vulnerable to sensitive data exposure via CORS misconfiguration - CVE-2025-53092
• pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding - CVE-2025-11362

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@strapi/strapi