Description (CNA)
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| strapi / strapi | affected 0 before 5.7.0 |
CWE
CWE-327
References
- https://github.com/strapi/strapi/issues/26587
- https://github.com/strapi/strapi/pull/26752
- https://github.com/strapi/strapi
- https://www.vulncheck.com/advisories/strapi-users-permissions-jwt-algorithm-confusion-via-missing-algorithm-configuration
ADP enrichment
No English description supplied.
No references supplied.