CVE-2026-57997

MediumCVSS 5.4/10Last modified Oct 25, 2026

Description

Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
strapi	strapi	< 5.7.0

References

https://github.com/strapi/strapiProduct
https://github.com/strapi/strapi/issues/26587Issue Tracking
https://github.com/strapi/strapi/pull/26752Issue Tracking, Patch
https://www.vulncheck.com/advisories/strapi-users-permissions-jwt-algorithm-confusion-via-missing-algorithm-configurationPatch, Third Party Advisory

Timeline

Published: Jun 29, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-579987.8better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry o CVE-2026-579998.8luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users CVE-2026-58006.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Dayneks Software Industry and Trade In CVE-2026-580008.8luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where CVE-2026-580015.7WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request aut CVE-2026-580026.5WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in the Users_affiliations CVE-2026-580037.1WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks CVE-2026-580048.1Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Tru CVE-2026-580058.1Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Tru CVE-2026-580068.1Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Me CVE-2026-580078.1Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Me CVE-2026-580088.1Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memo