CVE-2025-3930: 
JavaScript vulnerability analysis and mitigation

CVE-2025-3930 affects Strapi's authentication system, discovered and disclosed in October 2025. The vulnerability exists in versions prior to 5.24.1, where JSON Web Tokens (JWT) remain valid after user logout or account deactivation. The issue was initially reported by CERT.PL and affects the authentication mechanism of Strapi's admin panel (Strapi Blog, NVD).

The vulnerability stems from Strapi's JWT implementation where tokens are not invalidated upon logout or account deactivation. The tokens remain valid until their expiration date (30 days by default). Additionally, the /admin/renew-token endpoint allows for indefinite token renewal, compounding the security risk. The vulnerability has been assigned a CVSS 4.0 score of 6.3 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (NVD, CERT.PL).

The primary impact is on the admin panel, where compromised tokens can be reused until expiration. An attacker who has intercepted or stolen a token can continue to access the system even after the legitimate user has logged out. The vulnerability is particularly concerning due to the ability to indefinitely renew tokens through the /admin/renew-token endpoint (Strapi Blog).

The vulnerability has been patched in Strapi version 5.24.1. Users should immediately update to this version or later. The fix includes a complete refactoring of the authentication system for both the Admin Panel and Users & Permissions, implementing a comprehensive session management system that tracks sessions per user, per device, and per session (Strapi Blog).

Strapi has demonstrated commitment to responsible disclosure by working with security researchers and implementing a staged disclosure process. They notified customers via multiple emails and included security notices in release notes before full disclosure. The company has encouraged the community to report security vulnerabilities through GitHub Advisory or by contacting their security team at security@strapi.io (Strapi Blog).