JWT Algorithm Restriction Issue in Strapi Users-Permissions Plugin

CVE-2026-57997

What is CVE-2026-57997?

The Strapi users-permissions plugin has a security flaw related to the configuration of JWT algorithms. When the jwt.algorithm parameter is not explicitly set, the plugin permits a broader range of algorithm tokens, including HS384 and HS512, alongside the standard HS256. This introduces a risk for attackers who possess the jwtSecret, enabling them to create tokens with non-standard HMAC variants. Such actions can allow them to bypass algorithm restrictions, ultimately compromising authentication mechanisms and increasing vulnerability to unauthorized access.

References