PT-2025-42459 · Strapi · Strapi

Arkadiusz Marta · Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-3930

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 5.24.1

Description Strapi utilizes JSON Web Tokens (JWT) for authentication. Following logout or account deactivation, JWTs are not invalidated, enabling an attacker with a stolen or intercepted token to reuse it until its expiration. The default expiration is 30 days, but this can be modified. The '/admin/renew-token' API endpoint allows indefinite renewal of near-expiration tokens, amplifying the impact of this issue.

Recommendations Update to version 5.24.1 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-3930

GHSA-4R8W-3JWW-M2RP

Affected Products

Strapi

References · 11

• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4r8w-3jww-m2rp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3930 · Security Note
• https://github.com/strapi/strapi · Note
• https://t.me/CVEtracker/35086 · Telegram Post
• https://strapi.io · Note
• https://cert.pl/en/posts/2025/06/CVE-2025-3930 · Note
• https://t.me/cveNotify/138932 · Telegram Post
• https://twitter.com/CVEnew/status/1978926609940799941 · Twitter Post
• https://cert.pl/posts/2025/06/CVE-2025-3930 · Note