CVE-2025-3930

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-3930
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3930.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-3930
Aliases
Published
2025-10-16T10:43:21.382Z
Modified
2026-07-15T01:49:21.630377649Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Lack of JWT Expiration after Log Out in Strapi
Details

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack.

This issue has been fixed in version 5.24.1.

Database specific 
{
    "cwe_ids": [
        "CWE-613"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3930.json",
    "cna_assigner": "CERT-PL"
}
References

Affected packages

Git / github.com/strapi/strapi

Affected ranges

Type
GIT
Repo
https://github.com/strapi/strapi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ff1eac610b7c8639ee13dd54714450d243aa6650
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.24.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.5
v1.0.6
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v3.*
v3.0.0-alpha.12.7
v3.0.0-alpha.12.7.1
v3.0.0-alpha.13
v3.0.0-alpha.23.1
v3.0.0-alpha.4
v3.0.0-alpha.4.8
v3.0.0-alpha.6.4
v3.0.0-alpha.6.7
v3.0.0-alpha.7.3
v3.0.0-alpha.9
v3.0.0-beta.0
v3.0.0-beta.1
v3.0.0-beta.10
v3.0.0-beta.11
v3.0.0-beta.12
v3.0.0-beta.13
v3.0.0-beta.14
v3.0.0-beta.15
v3.0.0-beta.16
v3.0.0-beta.16.1
v3.0.0-beta.16.2
v3.0.0-beta.16.3
v3.0.0-beta.16.4
v3.0.0-beta.16.5
v3.0.0-beta.16.6
v3.0.0-beta.16.7
v3.0.0-beta.16.8
v3.0.0-beta.17
v3.0.0-beta.17.1
v3.0.0-beta.17.2
v3.0.0-beta.17.4
v3.0.0-beta.17.5
v3.0.0-beta.17.6
v3.0.0-beta.17.7
v3.0.0-beta.17.8
v3.0.0-beta.18
v3.0.0-beta.18.1
v3.0.0-beta.18.2
v3.0.0-beta.18.3
v3.0.0-beta.18.4
v3.0.0-beta.18.5
v3.0.0-beta.18.6
v3.0.0-beta.18.7
v3.0.0-beta.18.8
v3.0.0-beta.19
v3.0.0-beta.19.1
v3.0.0-beta.19.2
v3.0.0-beta.19.3
v3.0.0-beta.19.4
v3.0.0-beta.2
v3.0.0-beta.20
v3.0.0-beta.3
v3.0.0-beta.4
v3.0.0-beta.5
v3.0.0-beta.6
v3.0.0-beta.7
v3.0.0-beta.8
v3.0.0-beta.9
v3.1.0
v3.1.3
v3.1.4
v3.2.1
v3.2.2
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.4.6
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7
v3.6.8
v4.*
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.1.0
v4.1.1
v4.1.10
v4.1.12
v4.1.3
v4.1.8
v4.1.9
v4.11.0
v4.13.1
v4.13.4
v4.2.2
v4.2.3
v4.25.16
v4.25.22
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.3.8
v4.3.9
v4.4.0
v4.4.1
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.6.0
v4.6.1
v4.7.0
v4.7.1
v4.8.2
v5.*
v5.0.0
v5.0.0-beta.10
v5.0.0-beta.11
v5.0.0-beta.12
v5.0.0-beta.13
v5.0.0-beta.14
v5.0.0-beta.15
v5.0.0-beta.16
v5.0.0-beta.3
v5.0.0-beta.6
v5.0.0-beta.7
v5.0.0-beta.8
v5.0.0-rc.0
v5.0.0-rc.1
v5.0.0-rc.12
v5.0.0-rc.14
v5.0.0-rc.15
v5.0.0-rc.16
v5.0.0-rc.17
v5.0.0-rc.18
v5.0.0-rc.19
v5.0.0-rc.2
v5.0.0-rc.20
v5.0.0-rc.21
v5.0.0-rc.22
v5.0.0-rc.23
v5.0.0-rc.24
v5.0.0-rc.25
v5.0.0-rc.26
v5.0.0-rc.27
v5.0.0-rc.28
v5.0.0-rc.29
v5.0.0-rc.30
v5.0.0-rc.5
v5.0.0-rc.6
v5.0.0-rc.9
v5.0.2-beta.0
v5.0.4
v5.14.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3930.json"