Strapi versions before 5.33.3 mishandled token revocation during password change or reset, failing to invalidate existing refresh tokens unless a caller supplied a deviceId. This flaw allows an attacker who has already acquired a valid refresh token to keep generating new access tokens even after the legitimate user has reset their password. The result is persistent unauthorized access for the lifetime of the token, up to 30 days by default, representing a serious authentication bypass (CWE-613).

The affected products are Strapi core, the @strapi/admin and @strapi/plugin-users-permissions modules. All releases older than 5.33.3 are vulnerable; the patch in 5.33.3 and later removes the deviceId requirement and revokes all user tokens on every password change or reset.

The vulnerability has a low CVSS score of 2.1 and no exploitation probability data is available, and it is not listed in the CISA KEV catalog. Because an attacker must already possess a refresh token to exploit the flaw, the attack involves an initial compromise. Once in possession, however, a password reset will not terminate the session, allowing prolonged unauthorized activity. The lack of a deviceId check means the revocation step never executes, making the issue straightforward to reproduce in affected systems.