{"id":"CVE-2025-3930","sourceIdentifier":"cvd@cert.pl","published":"2025-10-16T11:15:29.280","lastModified":"2026-10-19T16:10:00.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). \nThe existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. \n\nThis issue has been fixed in version 5.24.1."},{"lang":"es","value":"Strapi usa JSON Web Tokens (JWT) para la autenticación. Después del cierre de sesión o la desactivación de la cuenta, el JWT no se invalida, lo que permite a un atacante que ha robado o interceptado el token reutilizarlo libremente hasta su fecha de caducidad (que está configurada en 30 días por defecto, pero puede cambiarse).\nLa existencia del endpoint /admin/renew-token permite a cualquiera renovar tokens próximos a caducar indefinidamente, aumentando aún más el impacto de este ataque.\n\nEste problema ha sido solucionado en la versión 5.24.1."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"Strapi","product":"Strapi","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.24.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-16T13:37:13.822536Z","id":"CVE-2025-3930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://cert.pl/en/posts/2025/06/CVE-2025-3930","source":"cvd@cert.pl"},{"url":"https://github.com/strapi/strapi","source":"cvd@cert.pl"},{"url":"https://strapi.io/","source":"cvd@cert.pl"},{"url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025","source":"cvd@cert.pl"}]}