How severe is GHSA-hvp3-26wx-g2w4?

No CVSS score has been assigned to GHSA-hvp3-26wx-g2w4 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-hvp3-26wx-g2w4?

GHSA-hvp3-26wx-g2w4 affects the following packages: @strapi/admin (npm), @strapi/plugin-users-permissions (npm). Ecosystems affected: npm.

How do I fix GHSA-hvp3-26wx-g2w4?

Update @strapi/admin to 5.33.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hvp3-26wx-g2w4 is resolved across your whole dependency graph.

How do I detect GHSA-hvp3-26wx-g2w4 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @strapi/admin. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-hvp3-26wx-g2w4 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-hvp3-26wx-g2w4?

O3 pinpoints whether GHSA-hvp3-26wx-g2w4 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-hvp3-26wx-g2w4 actively exploited in the wild?

No public exploit code has been indexed for GHSA-hvp3-26wx-g2w4 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-hvp3-26wx-g2w4 published, and has it been updated?

GHSA-hvp3-26wx-g2w4 was published on May 13, 2026 and was last updated on May 16, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

GHSA-hvp3-26wx-g2w4

GHSA-hvp3-26wx-g2w4 is a security vulnerability in @strapi/admin. O3 Security confirms whether GHSA-hvp3-26wx-g2w4 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

Also known asCVE-2026-22706

Published

May 13, 2026

Updated

May 16, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of May 16, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

📦@strapi/admin📦@strapi/plugin-users-permissions

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.

Description

Summary of CVE-2026-22706 Vulnerability Details

CVE: CVE-2026-22706
CVSS v3.1 Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N (2.1 — Low)
Affected Versions: @strapi/admin and @strapi/plugin-users-permissions <=5.33.2
How to Patch: Immediately update your Strapi to >=5.33.3

Description of CVE-2026-22706

In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied deviceId. When a password change or reset request did not include a deviceId, no refresh tokens were revoked, leaving every prior session active.

An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure.

The patch invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a deviceId is supplied. A new device-scoped session is then issued to the caller as part of the response.

IoC's for CVE-2026-22706

Indicators that an instance running an unpatched version may have been exploited:

Successful POST /api/auth/refresh or POST /admin/access-token requests using a refresh token issued before the user's most recent password change. Reviewable by correlating refresh-token iat claims against password-change events in audit logs
New access-token issuances for a user whose password was reset within the past 30 days, originating from an IP or User-Agent that did not perform the reset
Multiple active refresh tokens for a single user across distinct IPs after a password reset event
Database query: rows in strapi_session with created_at earlier than the user's most recent password-reset timestamp and status = 'active'

References

OWASP ASVS 4.0 – V2.1.1: Session invalidation on credential change
OWASP Top 10 – A2: Broken Authentication

Credits

bugbunny.ai
AndyAnh174 (concurrent report, 2026-04-09 — originally filed as GHSA-c6gj-8rxm-jrf2, closed as duplicate)
Aastha2602 (concurrent report, 2026-03-10 — originally filed as GHSA-5qvg-4jch-gvf4, closed as duplicate)

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`@strapi/admin`	all versions	5.33.3
📦npm	`@strapi/plugin-users-permissions`	all versions	5.33.3

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @strapi/admin. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @strapi/admin to 5.33.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hvp3-26wx-g2w4 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-hvp3-26wx-g2w4 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-hvp3-26wx-g2w4. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary of CVE-2026-22706 Vulnerability Details - CVE: CVE-2026-22706 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` (2.1 — Low) - Affected Versions: `@strapi/admin` and `@strapi/plugin-users-permissions` <=5.33.2 - How to Patch: Immediately update your Strapi to >=5.33.3 ### Description of CVE-2026-22706 In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers

O3 Security · Impact-Aware SCA

Is GHSA-hvp3-26wx-g2w4 in your dependencies?

O3 detects GHSA-hvp3-26wx-g2w4 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works