Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

Description

No description available.

Recommendation

Update the @strapi/admin package to the latest compatible version. Followings are version details:

Affected version(s): <= 5.33.2
Patched version(s): 5.33.3

References

Could your website be exposed too?

SmartScanner can check your website for Strapi: Password Reset Does Not Revoke Existing Refresh Sessions and gives you actionable findings to investigate.

Start a free scan

Related Issues

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover - CVE-2026-44648
Strapi may leak sensitive user information, user reset password, tokens via content-manager views - CVE-2023-36472
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form- - CVE-2026-25155

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated May 15, 2026