CVE-2023-22893
CVE-2023-22893
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
CVSS 8.2 · High · EPSS 4.1% · Public exploit · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
@strapi/plugin-users-permissions npm
- Affected ranges
- SEMVER: ≥ 3.2.1, < 4.6.0
Update to 4.6.0