Beveiligingsadvies

CVE-2026-57997

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-29 21:16:35

Laatst bijgewerkt 2026-07-09 18:48:34

Toegewezen door VulnCheck

CVSS-score 6.3

Status PUBLISHED

Beschrijving

Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

← Alle CVE's bekijken Bekijk op cve.org ↗