CVE-2026-22706 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Attackers retain access via refresh tokens after password resets because sessions are not revoked, bypassing credential rotation security controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22706?
CVE-2026-22706 is a low-severity vulnerability in @strapi/admin, published on 14 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response.
Weakness: CWE-613
Which versions are affected by CVE-2026-22706?
4 open source packages ship an affected version, including @strapi/admin and @strapi/plugin-users-permissions. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@strapi/admin npm | All versions | 5.33.3 |
@strapi/admin npm | All versions | 5.33.3 |
@strapi/plugin-users-permissions npm | All versions | 5.33.3 |
@strapi/plugin-users-permissions npm | All versions | 5.33.3 |
Products include Strapi Strapi.
How do I fix CVE-2026-22706?
Upgrade @strapi/admin to 5.33.3 or later.
Is CVE-2026-22706 being exploited?
There is no known exploitation of CVE-2026-22706 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in @strapi/admin
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information
- CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
- CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi
- CVE-2020-27664 Authorization bypass in Strapi
- CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
Sources
Also known as GHSA-hvp3-26wx-g2w4.