Medium severity · published Oct 16, 2025
CVE-2025-3930
Lack of JWT Expiration after Log Out in Strapi
6.3
CVSS
0.7%
EPSS
No
On KEV
Description
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed).
The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack.
This issue has been fixed in version 5.24.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Strapi · Strapi
before 5.24.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3930
cert.pl
https://cert.pl/en/posts/2025/06/CVE-2025-3930
github.com
https://github.com/strapi/strapi
strapi.io
https://strapi.io/
strapi.io
https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025
More from Strapi
4.9
CVE-2023-22894
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter
9.8
CVE-2023-38507
Strapi is the an open-source headless content management system
9.8
CVE-2022-27263
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file
9.8
CVE-2020-27664
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality
9.8
CVE-2019-18818
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js