CVE-2026-57997 Details
Description
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
A vulnerability exists in the Strapi users-permissions plugin in versions prior to 5.7.0, where the plugin fails to properly restrict JSON Web Token (JWT) algorithms. When the JWT algorithm is not explicitly configured, the plugin accepts tokens signed with HS384 and HS512, in addition to the standard HS256. This oversight allows attackers with knowledge of the JWT secret to create tokens using these non-standard HMAC algorithms, bypassing intended algorithm restrictions and potentially undermining authentication processes.
Users can upgrade to Strapi version 5.7.0 or later, where this vulnerability has been fixed. Alternatively, the JWT algorithm can be manually set to HS256 in the users-permissions plugin configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strapi/strapi | [email protected] | Product |
| https://github.com/strapi/strapi/issues/26587 | [email protected] | Issue Tracking |
| https://github.com/strapi/strapi/pull/26752 | [email protected] | Issue TrackingPatch |
| https://www.vulncheck.com/advisories/strapi-users-permissions-jwt-algorithm-confusion-via-missing-algorithm-configuration | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| strapi strapi | < 5.7.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | New CVE Received | [email protected] |