CVE-2025-3930: Strapi JWT Auth Bypass Vulnerability

CVE-2025-3930 Overview

Strapi, an open-source headless content management system (CMS), fails to invalidate JSON Web Tokens (JWTs) after user logout or account deactivation. An attacker who steals or intercepts a valid token can reuse it for the full token lifetime, which defaults to 30 days. The /admin/renew-token endpoint compounds the issue by allowing any holder of a near-expiration token to renew it indefinitely. The vulnerability is classified under CWE-613: Insufficient Session Expiration. Strapi resolved the issue in version 5.24.1.

Critical Impact
A stolen JWT remains valid after logout or account deactivation and can be renewed without limit through the admin token renewal endpoint, granting persistent unauthorized access.

Affected Products

Strapi CMS versions prior to 5.24.1
Strapi admin panel authentication subsystem
Deployments exposing the /admin/renew-token endpoint

Discovery Timeline

2025-10-16 - CVE-2025-3930 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3930

Vulnerability Analysis

Strapi authenticates administrative users by issuing signed JWTs. The server validates these tokens on each request by verifying the signature and expiration claim. Strapi does not maintain a server-side revocation list or token blocklist.

When a user clicks logout, the client-side session ends but the token itself remains cryptographically valid. The same holds true when an administrator deactivates an account. Any party that captured the token through browser storage theft, network interception, or log exposure can continue to authenticate to the Strapi admin API.

The default 30-day token lifetime creates a substantial window for abuse. The /admin/renew-token endpoint accepts near-expiration tokens and issues new ones, allowing an attacker to extend access indefinitely without ever needing user credentials.

Root Cause

The root cause is insufficient session expiration [CWE-613]. Strapi treats JWT validity as the sole authorization signal and lacks a server-side mechanism to invalidate active sessions on logout or account state changes.

Attack Vector

An attacker first obtains a valid admin JWT through cross-site scripting, malware-based browser storage exfiltration, intercepted requests, or exposed application logs. The attacker then submits the token in the Authorization: Bearer header to authenticated Strapi admin endpoints. Before expiration, the attacker calls /admin/renew-token to obtain a refreshed token, repeating this process to maintain persistent access. Refer to the CERT Poland Advisory CVE-2025-3930 and the Strapi security disclosure blog post for further technical detail.

Detection Methods for CVE-2025-3930

Indicators of Compromise

Repeated successful requests to /admin/renew-token from unusual IP addresses or user agents
Admin API activity from IP addresses that never authenticated via the login flow
Continued API access from accounts that were logged out or deactivated
JWT reuse patterns where the same token identifier appears from geographically dispersed sources

Detection Strategies

Correlate logout events in application logs with subsequent API activity carrying the same token identifier or session context
Monitor authentication logs for admin API access without a preceding /admin/login event
Alert on repeated calls to /admin/renew-token outside of normal user working hours or from atypical sources
Baseline normal token renewal frequency per user and flag deviations

Monitoring Recommendations

Ingest Strapi admin access logs into a centralized logging platform for retention and correlation
Track token issuance and renewal events with source IP, user agent, and timestamp metadata
Review admin account deactivation events and verify no further API activity occurs from that user
Enable network egress monitoring on Strapi hosts to identify unexpected outbound calls from admin sessions

How to Mitigate CVE-2025-3930

Immediate Actions Required

Upgrade Strapi to version 5.24.1 or later, which enforces server-side JWT invalidation
Rotate the JWT signing secret to invalidate all existing tokens after upgrade
Force logout of all admin users and require re-authentication
Audit admin accounts and remove or reset any that were previously deactivated but may retain valid tokens

Patch Information

Strapi released the fix in version 5.24.1. Administrators should review the Strapi security disclosure blog post and the Strapi GitHub repository for release notes and upgrade guidance.

Workarounds

Reduce the JWT expiration time from the 30-day default to a shorter window such as 1 to 4 hours
Restrict access to the /admin/renew-token endpoint using a reverse proxy or web application firewall until patched
Place the Strapi admin interface behind a VPN or IP allowlist to limit token capture opportunities
Rotate the JWT signing secret whenever a privileged user is deactivated to invalidate outstanding tokens

bash

# Example: shorten JWT lifetime in Strapi admin configuration
# config/admin.js
module.exports = ({ env }) => ({
  auth: {
    secret: env('ADMIN_JWT_SECRET'),
    options: {
      expiresIn: '1h',
    },
  },
});