Vulnerability · Published Oct 16, 2025 · Assigned by CERT-PL

CVE-2025-3930Lack of JWT Expiration after Log Out in Strapi

Medium 6.3

In plain English

A medium-severity security flaw in Strapi from Strapi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.7%top 46.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@strapi/strapi	5.24.1	GHSA-4r8w-3jww-m2rp

Affected products (as reported)

Vendor	Product	Versions
Strapi	Strapi	0 – before 5.24.1

Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/06/CVE-2025-3930 third-party-advisory
https://github.com/strapi/strapi product
https://strapi.io/ product
https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025 vendor-advisory