Strapi JWT tokens persist after logout
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Strapi fails to invalidate JSON Web Tokens on logout or account deactivation, allowing token reuse until expiration.
Strapi uses JWT tokens for authentication but does not invalidate them when an account is logged out or deactivated. An attacker who has obtained a valid JWT—through theft, interception, or credential compromise—can reuse it to maintain authenticated access to the application for up to 30 days (the default token lifetime, configurable by administrators). The vulnerability is further amplified by an unauthenticated /admin/renew-token endpoint that allows any token holder to refresh a near-expiring JWT indefinitely, extending the window of compromise without limit. This allows persistent unauthorized access even after the legitimate user has logged out or their account has been disabled. The issue affects Strapi versions prior to 5.24.1, which includes the fix. Defenders should immediately patch affected instances and review logs for suspicious token renewal patterns or authenticated activity following user logouts.
Mentioned in this report
Detection guidance
Strapi Admin Token Renewal Request
Flags successful requests to the Strapi /admin/renew-token endpoint, which can be abused to refresh a stolen or stale JWT indefinitely. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Strapi Admin Token Renewal Request
id: e28fe866-7dc7-5a5c-bc76-60148ad799f6
status: experimental
description: Detects requests to the Strapi /admin/renew-token endpoint. In Strapi
versions before 5.24.1 a holder of a near-expiry JWT can renew it indefinitely,
even after logout or account deactivation. Legitimate admin UI sessions also call
this endpoint, so triage by volume and source (many renewals from one IP, renewals
long after the user logged out, or renewals from an IP that differs from the user's
normal one). A threshold cannot be encoded in this rule.
tags:
- attack.persistence
- attack.t1550.001
logsource:
category: webserver
detection:
selection:
cs-uri-stem|endswith: /admin/renew-token
cs-method: POST
sc-status:
- 200
- 201
condition: selection
fields:
- c-ip
- cs-user-agent
- cs-uri-stem
- sc-status
falsepositives:
- Normal Strapi admin panel sessions that renew the token automatically while an administrator
is working
level: low
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-3930
Strapi Token Renewal From Scripted HTTP Client
Flags /admin/renew-token requests made by command-line or scripting HTTP clients rather than a browser, suggesting scripted reuse of a stolen JWT. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Strapi Token Renewal From Scripted HTTP Client
id: f578959c-6032-53f3-9982-daab2c77f848
status: experimental
description: Detects calls to the Strapi /admin/renew-token endpoint from non-browser
user agents such as curl, python-requests or Go-http-client. This suggests automated
reuse and extension of a stolen JWT, which stays valid after logout in Strapi versions
before 5.24.1.
tags:
- attack.persistence
- attack.stealth
- attack.t1550.001
- attack.t1078.001
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|endswith: /admin/renew-token
selection_ua:
cs-user-agent|contains:
- curl/
- python-requests
- python-urllib
- Go-http-client
- Wget/
- PostmanRuntime
- axios/
- node-fetch
- okhttp
- libwww-perl
condition: selection_uri and selection_ua
fields:
- c-ip
- cs-user-agent
- cs-uri-stem
- sc-status
falsepositives:
- Authorized API integrations or monitoring scripts that deliberately call the renew-token
endpoint
- Penetration tests against the Strapi instance
level: medium
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-3930
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-3930
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs