AIKIDO-2026-10066
@strapi/core is vulnerable to Insufficient Session Expiration
25
Low Risk
This Affects:
@strapi/coreTL;DR
Affected versions of this package are vulnerable to insufficient session expiration because active sessions or refresh tokens remain valid after a user changes or resets their password, allowing previously compromised sessions to continue being used. In Strapi, this behavior could enable an attacker with access to a stolen session to maintain unauthorized access even after credentials are updated. The patch fixes this by revoking existing sessions and tokens upon password changes and resets, ensuring continued access requires reauthentication.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@strapi/core is vulnerable to Insufficient Session Expiration in versions 1.0.0 - 5.33.2.
How to fix this
Upgrade the @strapi/core library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant