PT-2026-53747 · Strapi · Users-Permissions Plugin

Bl4Ck570Rm · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-57997

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Strapi users-permissions plugin (affected versions not specified)

Description The users-permissions plugin fails to restrict JSON Web Token (JWT) algorithms when the plugin::users-permissions.jwt.algorithm configuration is not explicitly set. This allows the system to accept HS384 and HS512 tokens in addition to HS256. An attacker who possesses the jwtSecret can create tokens using these non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

Recommendations Explicitly configure the plugin::users-permissions.jwt.algorithm setting to restrict the accepted JWT algorithms. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2026-57997

Affected Products

Users-Permissions Plugin

References · 7

• https://github.com/strapi/strapi/pull/26752 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-57997 · Security Note
• https://github.com/strapi/strapi · Note
• https://github.com/strapi/strapi/issues/26587 · Note
• https://twitter.com/infoflowcloud/status/2071737089230540937 · Twitter Post
• https://twitter.com/CVEnew/status/2071735287177257362 · Twitter Post
• https://vulncheck.com/advisories/strapi-users-permissions-jwt-algorithm-confusion-via-missing-algorithm-configuration · Note