By vendor

Strapi vulnerabilities

Known CVEs affecting Strapi products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-57997MEDIUM 4.8

  Strapi's users-permissions plugin has a cryptographic configuration flaw that allows attackers to bypass JWT (JSON Web Token) authentication controls. When administrators don't explicitly set the allowed JWT algorithm in their configuration, the plugin accepts multiple HMAC variants (HS384 and HS512) in addition to the default HS256. If an attacker obtains the JWT secret key—whether through a separate compromise, supply chain attack, or insider access—they can create valid tokens using these alternative algorithms to impersonate users and gain unauthorized access.