Executive brief
Strapi, a popular content management system, failed to properly terminate all active user sessions when a password was changed or reset. This means that if an attacker had already gained unauthorized access to an account, they could remain logged in even after the legitimate owner changed their password to lock them out. This flaw undermines password resets as a security measure, potentially allowing unauthorized access to persist for up to 30 days.
Technical details
A vulnerability in Strapi's authentication logic exists where the refresh-token invalidation step in the 'users-permissions' and 'admin' controllers is conditionally tied to a caller-supplied 'deviceId'. If a password reset or change request is made without this identifier, existing refresh tokens remain valid in the database. An attacker possessing a valid refresh token can continue to generate new access tokens for the duration of the refresh token's lifespan (defaulting to 30 days), even after the user's credentials have been rotated. This issue is classified as CWE-613 (Insufficient Session Expiration). Version 5.33.3 addresses this by ensuring all refresh tokens associated with a user are invalidated upon password modification, regardless of the presence of a device ID.
Affected products
- Strapi Strapi < 5.33.3
- Strapi @strapi/admin <= 5.33.2
- Strapi @strapi/plugin-users-permissions <= 5.33.2
Timeline
- 2026-05-13: advisory: GitHub advisory published by maintainers
- 2026-05-14: disclosed: CVE published to NVD