Strapi - Authentication Bypass (CVE-2023-22893)
Description
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
psychologyCrowdSec Analysis
CVE-2023-22893 is a vulnerability in Strapi through version 4.5.5 which allows remote attackers to bypass authentication when AWS Cognito is used as the login provider, due to improper verification of access or ID tokens during the OAuth flow. Attackers can forge ID tokens signed with the 'None' algorithm, enabling them to impersonate any user and potentially gain unauthorized access to sensitive resources or perform actions as legitimate users. This flaw could be exploited for account takeover, privilege escalation, or data theft.
CrowdSec has been tracking this vulnerability and its exploits since 12th of June 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-22893 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /api/auth/cognito/callback endpoint by supplying a forged id_token JWT with the "none" algorithm, allowing them to bypass authentication and impersonate users in vulnerable Strapi instances.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-04-19 |
| Rule Released | 2025-06-12 |
| CrowdSec First Seen | 2025-06-23 |