CVE-2025-3930 - CVE House
Back to Database
Status published Medium CVE-2025-3930

Lack of JWT Expiration after Log Out in Strapi

Vulnerability Description

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3930

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Arkadiusz Marta

References

More from Strapi

View All →
CVE-2022-30618
An authenticated user with access to the Strapi admin panel...
High 7.5
CVE-2022-30617
An authenticated user with access to the Strapi admin panel...
High 8.8
CVE-2022-29894
Strapi v3.x.x versions and earlier contain a stored cross-site scripting...
Medium 4.8

Affected Vendor

Affected Software

Strapi
Vulnerable Versions:
0

Timeline

Official Publish: October 16th, 2025
Last Modified: October 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-613

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie
Credential Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1562 Impair Defenses
Defense Evasion