Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/strapi/strapi/pull/26752 Issue Tracking, Patch
- https://www.vulncheck.com/advisories/strapi-users-permissions-jwt-algorithm-confusion-via-missing-algorithm-configuration Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.3 · strapiNVD modified 2026-10-25 21:10
Affected (CPE criteria) 1
cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*
References 4
- https://github.com/strapi/strapi Product
- https://github.com/strapi/strapi/issues/26587 Issue Tracking
- https://github.com/strapi/strapi/pull/26752 Issue Tracking, Patch
- https://www.vulncheck.com/advisories/strapi-users-permissions-jwt-algorithm-confusion-via-missing-algorithm-configuration Patch, Third Party Advisory