CVE-2025-3930— Lack of JWT Expiration after Log Out in Strapi
Quick assessment
Affected
Strapi Strapi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Strapi是法国strapi社区的一套开源的内容管理系统（CMS）。 Strapi 5.24.1之前版本存在代码问题漏洞，该漏洞源于注销或停用账户后未使JWT失效且存在/admin/renew-token端点，可能导致令牌被恶意重用。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-3930
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Lack of JWT Expiration after Log Out in Strapi
Source: CVE Program / CVE List V5
Vulnerability Description
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed).
The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack.
This issue has been fixed in version 5.24.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
Strapi 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Strapi是法国strapi社区的一套开源的内容管理系统（CMS）。 Strapi 5.24.1之前版本存在代码问题漏洞，该漏洞源于注销或停用账户后未使JWT失效且存在/admin/renew-token端点，可能导致令牌被恶意重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-3930
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-3930
请登录查看更多情报信息。
Same Patch Batch · Strapi · 2025-10-16 · 4 CVEs total
| CVE-2024-56143 | 8.2 HIGH | Strapi Allows Unauthorized Access to Private Fields via parms.lookup |
| CVE-2025-53092 | 6.5 MEDIUM | Strapi core vulnerable to sensitive data exposure via CORS misconfiguration |
| CVE-2025-25298 | Missing Maximum Password Length Validation in Strapi Password Hashing |
IV. Related Vulnerabilities
Same product: Strapi
-
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS v -
CVE-2026-57997
Strapi users-permissions - JWT Algorithm Confusion via Missi -
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due -
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API -
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sess
Same vendor: Strapi
-
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS v -
CVE-2026-57997
Strapi users-permissions - JWT Algorithm Confusion via Missi -
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due -
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API -
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sess
Same weakness: CWE-613
-
CVE-2026-97212
Monta monta.app Insufficient Session Expiration -
CVE-2026-104468
YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via -
CVE-2026-66253
HCL iControl is affected by a Session Timeout vulnerability -
CVE-2026-103283
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session -
CVE-2026-103279
Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
V. Comments for CVE-2025-3930
No comments yet