CVE-2026-57997: Strapi Authentication Bypass Vulnerability

CVE-2026-57997 Overview

CVE-2026-57997 affects the Strapi users-permissions plugin, which fails to restrict accepted JSON Web Token (JWT) algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured. The plugin accepts HS384 and HS512 tokens alongside the expected HS256, creating an algorithm confusion condition. Attackers who possess the jwtSecret can mint tokens using non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls. The weakness is classified under [CWE-327] Use of a Broken or Risky Cryptographic Algorithm.

Critical Impact
Attackers with knowledge of the jwtSecret can forge JWTs using unintended HMAC algorithms, bypassing algorithm allow-listing and compromising authentication integrity in Strapi deployments.

Affected Products

Strapi (Node.js) — users-permissions plugin
Deployments where plugin::users-permissions.jwt.algorithm is not explicitly configured
All Strapi instances prior to the patch delivered in Strapi Pull Request #26752

Discovery Timeline

2026-06-29 - CVE-2026-57997 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-57997

Vulnerability Analysis

The Strapi users-permissions plugin issues and validates JWTs used for authenticating end users of the content API. When administrators do not explicitly set plugin::users-permissions.jwt.algorithm, the verification routine falls back to a permissive default that accepts multiple HMAC-SHA variants. Tokens signed with HS256, HS384, or HS512 are all treated as valid, even when the deployment intends to enforce a single algorithm.

Algorithm confusion in JWT libraries has a documented history of enabling authentication bypass and signature forgery. In this case, the flaw does not permit forgery without the secret. An attacker still requires knowledge of the jwtSecret. However, the missing restriction erodes defense-in-depth and violates cryptographic hygiene principles captured in [CWE-327].

Root Cause

The root cause is a missing explicit algorithm allow-list during JWT verification. The plugin relies on the underlying JWT library's default behavior, which permits any supported HMAC variant when no algorithm parameter is supplied. This is a configuration and design flaw rather than a memory-safety issue.

Attack Vector

Exploitation requires network access to the Strapi API and possession of the jwtSecret. An attacker with the secret — for example, through a prior secret leak, misconfigured environment file, or insider access — can mint tokens using HS384 or HS512. These tokens are accepted by verification logic that should have been constrained to HS256. Further technical context is available in the VulnCheck Security Advisory and GitHub Issue #26587.

Detection Methods for CVE-2026-57997

Indicators of Compromise

Authentication events showing JWTs signed with HS384 or HS512 where operational policy expects HS256
Unexpected alg header values in decoded JWTs presented to /api/* endpoints served by the users-permissions plugin
Successful authentications from user accounts or IP addresses that have never previously authenticated to the Strapi instance

Detection Strategies

Parse JWTs at the reverse proxy or WAF layer and log the alg claim; alert on any algorithm other than the sanctioned value
Review application logs for authentication anomalies correlated with the presence of tokens using non-standard algorithms
Audit Strapi configuration files and environment variables for a missing or empty plugin::users-permissions.jwt.algorithm setting

Monitoring Recommendations

Enable verbose logging on the users-permissions plugin and forward events to a centralized log platform
Rotate and monitor access to the jwtSecret, treating any secret exposure as an authentication compromise event
Track configuration drift on Strapi deployments to ensure the JWT algorithm setting remains pinned after remediation

How to Mitigate CVE-2026-57997

Immediate Actions Required

Upgrade Strapi to a version that includes the fix delivered in Strapi Pull Request #26752
Explicitly configure plugin::users-permissions.jwt.algorithm to a single approved algorithm such as HS256
Rotate the jwtSecret and invalidate outstanding sessions if secret exposure is suspected
Audit historical authentication logs for tokens signed with HS384 or HS512

Patch Information

Strapi maintainers addressed the issue in Pull Request #26752, which enforces an explicit JWT algorithm during verification. Administrators should upgrade to the patched release and confirm that the plugin no longer accepts non-configured algorithms. Additional detail is provided in the VulnCheck advisory and the upstream Strapi repository.

Workarounds

Set plugin::users-permissions.jwt.algorithm explicitly to HS256 in the plugin configuration file until the patched version can be deployed
Restrict network exposure of the Strapi API to trusted networks while remediation is in progress
Enforce strict access controls on environment variables and configuration files that contain the jwtSecret

bash

# Configuration example: config/plugins.js
module.exports = ({ env }) => ({
  'users-permissions': {
    config: {
      jwt: {
        algorithm: 'HS256',
        expiresIn: '7d',
      },
      jwtSecret: env('JWT_SECRET'),
    },
  },
});