CVE-2023-22893

Strapi does not verify the access or ID tokens issued during the OAuth flow

7.5 HighFix available

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

4.12%Up 4.1 points since Apr 20, 2023

What each source reports

NVD Score used 7.5

Record: CVE-2023-22893
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

CVE List 8.2

Record: CVE-2023-22893
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2023-1203 8.2

Record: EUVD-2023-1203
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-583x-23h9-f5w7 No score

Strapi does not verify the access or ID tokens issued during the OAuth flow

Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

Record: GHSA-583x-23h9-f5w7
Updated: 2026-11-02

OSV 8.2

Record: CVE-2023-22893
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-02

OSVGHSA-583x-23h9-f5w7 No score

Strapi does not verify the access or ID tokens issued during the OAuth flow

Record: GHSA-583x-23h9-f5w7
Updated: 2026-11-02

Affected products

strapi

Affected packages

Affected packages
Package	Affected	Fixed
`@strapi/plugin-users-permissions` npm	3.2.1 up to 4.6.0	4.6.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Strapi Versions <=4.5.6 - Authentication Bypass

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-22893 is a high vulnerability (CVSS 7.5) in Strapi, published April 19, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.12%, the 90th percentile. Fixed in @strapi/plugin-users-permissions 4.6.0.

References

Show 5 moreShow less