Vulnerability	Vulnerable Version
M Weak Encoding for Password @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Weak Encoding for Password in to the implementation of password hashing. An attacker can reduce the effective entropy of user passwords and potentially mislead users about the required password length by submitting passwords longer than 72 bytes, which are silently truncated during hashing. How to fix Weak Encoding for Password? Upgrade `@strapi/admin` to version 5.10.3 or higher.	<5.10.3
M Insufficient Session Expiration @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JWT after logout or account deactivation. An attacker can maintain unauthorized access by reusing a stolen or intercepted token until it expires. The presence of the `/admin/renew-token` endpoint allows indefinite renewal of near-expiration tokens, further extending the attack window. How to fix Insufficient Session Expiration? Upgrade `@strapi/admin` to version 5.24.2 or higher.	<5.24.2

Weak Encoding for Password

@strapi/admin is a Strapi Admin

Affected versions of this package are vulnerable to Weak Encoding for Password in to the implementation of password hashing. An attacker can reduce the effective entropy of user passwords and potentially mislead users about the required password length by submitting passwords longer than 72 bytes, which are silently truncated during hashing.

How to fix Weak Encoding for Password?

Upgrade @strapi/admin to version 5.10.3 or higher.

<5.10.3

Insufficient Session Expiration

@strapi/admin is a Strapi Admin

Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JWT after logout or account deactivation. An attacker can maintain unauthorized access by reusing a stolen or intercepted token until it expires. The presence of the /admin/renew-token endpoint allows indefinite renewal of near-expiration tokens, further extending the attack window.

How to fix Insufficient Session Expiration?

Upgrade @strapi/admin to version 5.24.2 or higher.

<5.24.2

Go back to all versions of this package