CVE-2023-22893 json
Strapi does not verify the access or ID tokens issued during the OAuth flow
published 2023-04-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-583x-23h9-f5w7 , EUVD-2023-1203
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.1%
- EPSS 4.1% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
Patch / fix
- npm @strapi/plugin-users-permissions 4.6.0
- strapi strapi 4.6.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
4.12% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Strapi Versions <=4.5.6 - Authentication Bypass nuclei detection template
- ghostccamm.com https://www.ghostccamm.com/blog/multi_strapi_vulns/ referenced PoC, tagged "exploit" by a source, unverified
- strapi.io https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @strapi/plugin-users-permissions | >=3.2.1, <4.6.0 |
4.6.0 |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/strapi/strapi/commit/46f8f98378338f18b5c6139d0157a8f71bf4de83
web
-
github.com
/strapi/strapi/commit/8bbbd7383a20bb7cb163c8b462baffee559e994f
web
-
github.com
/strapi/strapi/commit/eeab43b57707d7ef275076d27be6eabc72bd71a7
web
-
ghostccamm.com
/blog/multi_strapi_vulns/
exploit, third-party-advisory
-
strapi.io
/blog/security-disclosure-of-vulnerabilities-cve
web, exploit, vendor-advisory
-
github.com
/strapi/strapi/releases
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-22893
advisory
-
github.com
/strapi/strapi
package
-
github.com
/strapi/strapi/blob/v4.5.6/packages/plugins/users-permissions/server/services/providers-registry.js
web
-
ghostccamm.com
/blog/multi_strapi_vulns
web
Sources
- CVE List CVE-2023-22893
- GitHub Advisory GHSA-583x-23h9-f5w7
- NVD CVE-2023-22893
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.