PT-2026-40835 · Strapi · Strapi

Aastha2602 + 4 · Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-22706

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 5.33.3

Description Changing or resetting a user's password does not invalidate existing refresh-token sessions by default. In the users-permissions and admin authentication controllers, the invalidation process depends on a caller-supplied deviceId. If a password change or reset request is made without a deviceId, no refresh tokens are revoked, which keeps all previous sessions active. This allows an attacker with a previously obtained refresh token to continue generating new access tokens even after a password reset, enabling unauthorized access for the duration of the refresh token's lifetime, which is 30 days by default.

Recommendations Update to version 5.33.3 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-22706

GHSA-HVP3-26WX-G2W4

Affected Products

Strapi

References · 4

• https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22706 · Security Note
• https://osv.dev/vulnerability/GHSA-hvp3-26wx-g2w4 · Vendor Advisory
• https://github.com/strapi/strapi · Note