Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706 | SmartScanner

Description

No description available.

Recommendation

Update the @strapi/plugin-users-permissions package to the latest compatible version. Followings are version details:

Affected version(s): <= 5.33.2
Patched version(s): 5.33.3

References

Could your website be exposed too?

SmartScanner can check your website for Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions and gives you actionable findings to investigate.

Start a free scan

Related Issues

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - CVE-2026-22706
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin - CVE-2023-22621
Unauthorized Access to Private Fields in User Registration API - @strapi/plugin-users-permissions - CVE-2023-39345
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass - CVE-2024-34065

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated May 15, 2026