The Strapi users-permissions plugin does not enforce a mandatory JWT algorithm configuration when plugin::users-permissions.jwt.algorithm is absent, allowing the use of HMAC SHA-384 (HS384) and HMAC SHA-512 (HS512) tokens in addition to the expected HS256. An attacker who has access to the jwtSecret can generate tokens signed with these weaker or non‑standard algorithms and present them to the application, thereby bypassing authentication and gaining access without proper verification. This vulnerability directly undermines the integrity of the authentication process and can lead to unauthorized access to protected resources.

The issue is confined to the Strapi application, specifically the users-permissions plugin. No specific version information is provided in the data; therefore, any deployment that has not applied known fixes may be vulnerable. The Strapi vendor is responsible for addressing the issue in future releases.

With a CVSS score of 6.3, the vulnerability is considered moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers need possession of the jwtSecret to construct malicious tokens, so the exploitation likelihood depends on successful secret compromise or misconfiguration. If an attacker gains that secret, the forgery of valid tokens is straightforward and requires no additional access privileges.