CVE-2026-57997
Medium · 4.8CVSS
4.8
EPSS
0.2%
Published
Jun 29, 2026
CISA due date
—
The record
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118684 MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in… CWE-327
- CVE-2026-108015 Private keys for eight eMudhra intermediate CA certificates have been compromised… CWE-327
- CVE-2026-108014 Private keys for eight eMudhra intermediate CA certificates have been compromised… CWE-327
- CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-327
- CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-327
- CVE-2026-6930 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that… CWE-327
- CVE-2025-36084 IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that… CWE-327
- CVE-2026-81822 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-327