CVE-2025-3930CWE-613

CVE-2025-3930

published October 16, 2025

CVSS
6.3
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed).

The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack.

This issue has been fixed in version 5.24.1.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2025-10-16T15:15Z
References (4)
https://cert.pl/en/posts/2025/06/CVE-2025-3930 · [email protected]https://github.com/strapi/strapi · [email protected]https://strapi.io/ · [email protected]https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025 · [email protected]
EPSS history
Timeline
  • 16 OCT 10:43Z
    Lack of JWT Expiration after Log Out in Strapi
    cvelistv5