Strapi up to 5.33.2 session expiration

Summaryinfo

A vulnerability was found in Strapi up to 5.33.2. It has been rated as problematic. This affects an unknown function. The manipulation leads to session expiration. This vulnerability is referenced as CVE-2026-22706. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Strapi up to 5.33.2 and classified as problematic. This issue affects an unknown function. The manipulation with an unknown input leads to a session expiration vulnerability. Using CWE to declare the problem leads to CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." Impacted is integrity. The summary by CVE is:

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-22706 since 01/08/2026. The exploitation is known to be difficult. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 5.33.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1552). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Open Source Strapi

Productinfo

Name

• Strapi

Version

• 5.33.0
• 5.33.1
• 5.33.2

Website

• Product: https://github.com/strapi/strapi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion