# CVE-2019-18818: Strapi password reset authentication bypass

Source: https://junglewise.ai/threats/cve-2019-18818-strapi-password-reset-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-12-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-18818 · Severity: low · CVSS 3.1 · Published 2019-12-02

Strapi is an open-source headless CMS platform used to manage and deliver content to applications. This vulnerability allows an unauthenticated attacker to reset an administrator's password without possessing a valid reset token, enabling complete takeover of the system. An attacker could gain full administrative access and compromise all content, user data, and system configurations.

Technologies: [strapi (npm)](https://junglewise.ai/threats/technologies/strapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-18818 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-18818 being exploited in the wild.

**How severe is CVE-2019-18818?** Low severity, with a CVSS score of 3.1, published 2 December 2019.

**Which products and versions are affected?** strapi (npm) SEMVER:introduced=0,fixed=3.0.0-beta.17.5.

**Is there a fix for CVE-2019-18818?** Yes. strapi (npm): upgrade to 3.0.0-beta.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-18818 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-18818?** Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- strapi (npm): upgrade to 3.0.0-beta.17.5 or later

  ```sh
  npm install strapi@3.0.0-beta.17.5
  ```


## Technical details

The password reset endpoint in Strapi versions prior to 3.0.0-beta.17.5 fails to properly validate password reset tokens, allowing an unauthenticated attacker to reset admin account credentials without providing a valid token. This is an authentication bypass vulnerability (CWE-640) affecting the password recovery mechanism. The vulnerability is network-reachable and requires no authentication or user interaction. An attacker can directly craft requests to the reset password route to overwrite administrator passwords, achieving privilege escalation and complete system compromise. The fix was released in version 3.0.0-beta.17.5 and later.

## Affected products

- Strapi Strapi < 3.0.0-beta.17.5

## Identifiers

- CVE-2019-18818
- GHSA-6xc2-mj39-q599

## Timeline

- 2019-11-07: disclosed
- 2019-11-04: patched: Fix merged in PR #4443
- 2019-12-02: advisory

## References

- [https://github.com/strapi/strapi/pull/4443](https://github.com/strapi/strapi/pull/4443)

## Related threats

- [Strapi information disclosure via hidden attributes in admin API](https://junglewise.ai/threats/cve-2022-31367-strapi-information-disclosure-via-hidden-attributes-in-admin-api)
- [Strapi stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2022-29894-strapi-stored-cross-site-scripting-in-file-upload)
- [Strapi improper input validation in email templates](https://junglewise.ai/threats/cve-2020-13961-strapi-improper-input-validation-in-email-templates)
- [Strapi sensitive information disclosure in admin panel](https://junglewise.ai/threats/cve-2022-30618-strapi-sensitive-information-disclosure-in-admin-panel)
- [Strapi sensitive information disclosure in admin responses](https://junglewise.ai/threats/cve-2022-30617-strapi-sensitive-information-disclosure-in-admin-responses)