CVE-2026-57997: Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Explicitly configure plugin::users-permissions.jwt.algorithm to HS256 so the plugin restricts accepted JWT HMAC algorithms and does not accept HS384/HS512 when the setting is missing.
Strapi users-permissions plugin plugin::users-permissions.jwt.algorithm = HS256
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57997?
CVE-2026-57997 has a medium severity rating of 4.8.
How do I fix CVE-2026-57997?
To fix CVE-2026-57997, you need to explicitly configure the jwt.algorithm setting in the Strapi users-permissions plugin.
What are the risks associated with CVE-2026-57997?
The risks with CVE-2026-57997 include unauthorized access through the acceptance of non-standard HMAC JWTs if the jwtSecret is compromised.
Which software is affected by CVE-2026-57997?
CVE-2026-57997 affects the Strapi users-permissions plugin.
When was CVE-2026-57997 published?
CVE-2026-57997 was published on June 29, 2026.