Strapi JSON Web Token Authentication Vulnerability Allowing Token Renewal and Reuse

A vulnerability exists in Strapi's authentication mechanism, which relies on JSON Web Tokens (JWT). After a user logs out or deactivates their account, the JWT remains valid and can be reused until it expires, which is typically set to 30 days but can be modified. This flaw enables an attacker to exploit stolen or intercepted tokens. Additionally, the presence of the /admin/renew-token endpoint allows for the indefinite renewal of tokens that are close to expiring, exacerbating the issue. This vulnerability has been addressed in Strapi version 5.24.1.

Impact

Exploitation of this vulnerability allows for unauthorized access using a valid JWT, potentially leading to unauthorized actions or data access within the application.

Remediation

Users can update to Strapi version 5.24.1 or later to address this vulnerability.