Description
By combining two vulnerabilities (an Open Redirect and session token sent as URL query parameter) in Strapi framework is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click).
Recommendation
Update the @strapi/plugin-users-permissions package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.24.2
- Patched version(s): 4.24.2
References
Could your website be exposed too?
SmartScanner can check your website for @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Authentication Bypass in @strapi/plugin-users-permissions - Vulnerability
- Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying - CVE-2025-64526
- Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706
- Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin - CVE-2023-22621
You might also like:
See something that needs correcting? Let us knowUpdated November 20, 2024