AIKIDO-2026-493176
@strapi/plugin-users-permissions is vulnerable to Use of a Broken or Risky Cryptographic Algorithm
54
Medium Risk
This Affects:
@strapi/plugin-users-permissionsTL;DR
The @strapi/plugin-users-permissions plugin does not pin the accepted JWT signing algorithms in legacy-support mode when plugin::users-permissions.jwt.algorithm is left unset. The verification call runs without an algorithms restriction, so tokens signed with HS384 or HS512 are accepted alongside the expected HS256. An attacker who possesses the jwtSecret can mint tokens using these alternative HMAC variants and have them accepted, weakening the intended algorithm restrictions. The fix defaults legacy verification to HS256 when no algorithm is configured.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have not explicitly set plugin::users-permissions.jwt.algorithm while using the default legacy JWT mode.
Background info
@strapi/plugin-users-permissions is vulnerable to Use of a Broken or Risky Cryptographic Algorithm in versions 0.0.1 - 5.49.0.
How to fix this
Upgrade the @strapi/plugin-users-permissions library to the patch version. Alternatively, you can pin the JWT algorithm to HS256 in the plugin configuration.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant