CVE-2025-3930: Lack of JWT Expiration after Log Out in Strapi
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack.
This issue has been fixed in version 5.24.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3930?
CVE-2025-3930 has a medium severity rating due to the potential for unauthorized access with stolen JSON Web Tokens.
How do I fix CVE-2025-3930?
To mitigate CVE-2025-3930, ensure that your application invalidates JSON Web Tokens upon logout or account deactivation.
Which versions of Strapi are affected by CVE-2025-3930?
CVE-2025-3930 affects Strapi versions up to 5.24.1.
What type of vulnerability is CVE-2025-3930?
CVE-2025-3930 is an authentication vulnerability related to the improper handling of JSON Web Tokens.
Can an attacker exploit CVE-2025-3930 remotely?
Yes, an attacker can exploit CVE-2025-3930 remotely if they have access to a valid JSON Web Token.