Skip to content
OpenAdvisories

Product · strapi

@strapi/admin

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.1
    CVE-2026-22706 Public exploit

    Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm