# Strapi JWT tokens persist after logout

Published: 2025-10-16 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/c0f4e3ed-c00a-5063-80e6-c5908bb2bcee/strapi-jwt-tokens-persist-after-logout

> Strapi fails to invalidate JSON Web Tokens on logout or account deactivation, allowing token reuse until expiration.

Strapi uses JWT tokens for authentication but does not invalidate them when an account is logged out or deactivated. An attacker who has obtained a valid JWT—through theft, interception, or credential compromise—can reuse it to maintain authenticated access to the application for up to 30 days (the default token lifetime, configurable by administrators). The vulnerability is further amplified by an unauthenticated /admin/renew-token endpoint that allows any token holder to refresh a near-expiring JWT indefinitely, extending the window of compromise without limit. This allows persistent unauthorized access even after the legitimate user has logged out or their account has been disabled. The issue affects Strapi versions prior to 5.24.1, which includes the fix. Defenders should immediately patch affected instances and review logs for suspicious token renewal patterns or authenticated activity following user logouts.

## Mentioned in this report

- Vulnerabilities: CVE-2025-3930

## Detection guidance (public sample)

### Strapi Admin Token Renewal Request

ATT&CK: T1550.001

Flags successful requests to the Strapi /admin/renew-token endpoint, which can be abused to refresh a stolen or stale JWT indefinitely. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Strapi Admin Token Renewal Request
id: e28fe866-7dc7-5a5c-bc76-60148ad799f6
status: experimental
description: Detects requests to the Strapi /admin/renew-token endpoint. In Strapi
  versions before 5.24.1 a holder of a near-expiry JWT can renew it indefinitely,
  even after logout or account deactivation. Legitimate admin UI sessions also call
  this endpoint, so triage by volume and source (many renewals from one IP, renewals
  long after the user logged out, or renewals from an IP that differs from the user's
  normal one). A threshold cannot be encoded in this rule.
tags:
- attack.persistence
- attack.t1550.001
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|endswith: /admin/renew-token
    cs-method: POST
    sc-status:
    - 200
    - 201
  condition: selection
fields:
- c-ip
- cs-user-agent
- cs-uri-stem
- sc-status
falsepositives:
- Normal Strapi admin panel sessions that renew the token automatically while an administrator
  is working
level: low
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-3930
```

### Strapi Token Renewal From Scripted HTTP Client

ATT&CK: T1550.001

Flags /admin/renew-token requests made by command-line or scripting HTTP clients rather than a browser, suggesting scripted reuse of a stolen JWT. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Strapi Token Renewal From Scripted HTTP Client
id: f578959c-6032-53f3-9982-daab2c77f848
status: experimental
description: Detects calls to the Strapi /admin/renew-token endpoint from non-browser
  user agents such as curl, python-requests or Go-http-client. This suggests automated
  reuse and extension of a stolen JWT, which stays valid after logout in Strapi versions
  before 5.24.1.
tags:
- attack.persistence
- attack.stealth
- attack.t1550.001
- attack.t1078.001
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: /admin/renew-token
  selection_ua:
    cs-user-agent|contains:
    - curl/
    - python-requests
    - python-urllib
    - Go-http-client
    - Wget/
    - PostmanRuntime
    - axios/
    - node-fetch
    - okhttp
    - libwww-perl
  condition: selection_uri and selection_ua
fields:
- c-ip
- cs-user-agent
- cs-uri-stem
- sc-status
falsepositives:
- Authorized API integrations or monitoring scripts that deliberately call the renew-token
  endpoint
- Penetration tests against the Strapi instance
level: medium
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-3930
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-3930

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c0f4e3ed-c00a-5063-80e6-c5908bb2bcee/strapi-jwt-tokens-persist-after-logout.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup