N/A

CVSS Score

Basic Information

CVE ID

CVE-2025-3930

GHSA ID

GHSA-4r8w-3jww-m2rp

EPSS Score

0.20129%

CWE

CWE-613

Published

10/16/2025

Updated

10/16/2025

KEV Status

Technology

JavaScript

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3930

CVE-2025-3930: Strapi is vulnerable to Insufficient Session Expiration

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

(GitHub Advisory)

N/A

CVSS Score

Basic Information

CVE ID

CVE-2025-3930

GHSA ID

GHSA-4r8w-3jww-m2rp

EPSS Score

0.20129%

CWE

CWE-613

Published

10/16/2025

Updated

10/16/2025

KEV Status

Technology

JavaScript

Technical Details

CVSS Vector

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@strapi/strapi	npm	< 5.24.1	5.24.1

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

Str*pi us*s JSON W** Tok*ns (JWT) *or *ut**nti**tion. **t*r lo*out or ***ount ****tiv*tion, t** JWT is not inv*li**t**, w*i** *llows *n *tt**k*r w*o **s stol*n or int*r**pt** t** tok*n to *r**ly r*us* it until its *xpir*tion **t* (w*i** is s*t to **

Reasoning

No *n*lysis *v*il**l*

N/A

Basic Information

Concerned about an active attack path?

CVE-2025-3930: Strapi is vulnerable to Insufficient Session Expiration

N/A

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI