EUVD-2026-40234
GHSA-93c7-w42j-xh4p
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity captures jwtSecret prerequisite; no Strapi privileges needed; limited confidentiality and integrity impact from auth bypass; no availability or scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
AnalysisAI
JWT algorithm confusion in Strapi's users-permissions plugin enables authentication control weakening when the plugin::users-permissions.jwt.algorithm setting is absent from configuration. The plugin silently accepts HS384 and HS512 tokens alongside the intended HS256, allowing an attacker who has already obtained the jwtSecret to mint tokens using non-standard HMAC variants and bypass any algorithm-enforcement logic. No public exploit code is identified at time of analysis and this vulnerability is not listed in CISA KEV; real-world risk is substantially bounded by the prerequisite of jwtSecret compromise, reflected in the CVSS 4.0 score of 6.3 with High Complexity and Presence-of-attack-requirement modifiers.
Technical ContextAI
Strapi (cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*) is a widely-used open-source headless CMS and API framework for Node.js. Its users-permissions plugin handles JWT issuance and validation for user authentication flows. The root cause is CWE-327 (Use of a Broken or Risky Cryptographic Algorithm): when plugin::users-permissions.jwt.algorithm is not explicitly set, the library's default permissive behavior allows the JWT verification step to accept tokens signed with any valid HMAC variant (HS256, HS384, HS512) rather than enforcing a single configured algorithm. Algorithm confusion vulnerabilities in JWT libraries arise when the verifier relies on the algorithm field embedded in the token header rather than a server-side allowlist, creating a surface for token forgery if the signing secret is known. The CVSS 4.0 vector (AV:N/AC:H/AT:P) confirms the network-accessible attack surface but acknowledges the specific prerequisite conditions that elevate complexity.
RemediationAI
An upstream fix is available via GitHub pull request #26752 at https://github.com/strapi/strapi/pull/26752; however, a formally tagged patched release version is not independently confirmed from the available input data - operators should monitor the Strapi releases page at https://github.com/strapi/strapi for the corresponding versioned release and upgrade promptly once available. As an immediate compensating control, explicitly configure the JWT algorithm in Strapi's plugin settings by setting plugin::users-permissions.jwt.algorithm to HS256 (or RS256 if asymmetric keys are used), which removes the permissive multi-algorithm acceptance behavior; this change has no functional side effects for legitimately issued tokens. Additionally, rotate the jwtSecret as a precautionary measure if there is any possibility of prior exposure, since the vulnerability's entire threat model depends on secret compromise. Restricting access to Strapi configuration files and secrets management infrastructure limits the prerequisite attack surface independently of whether the patch has been applied.
Strapi is the an open-source headless content management system. Rated critical severity (CVSS 9.8), this vulnerability
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XS
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. Rated high severity
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.
Strapi is an open-source content management system. Rated high severity (CVSS 8.1), this vulnerability is remotely explo
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password
strapi is an open-source headless CMS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no au
Strapi is an open-source headless content management system. Rated high severity (CVSS 7.5), this vulnerability is remot
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login pro
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitra
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today