# CVE-2023-22893: Strapi - Authentication Bypass

> Live exploitation tracking for CVE-2023-22893 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-22893

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Strapi
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** cms

## Description

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

## CrowdSec analysis

[CVE-2023-22893](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-22893) is a vulnerability in Strapi through version 4.5.5 which allows remote attackers to bypass authentication when AWS Cognito is used as the login provider, due to improper verification of access or ID tokens during the OAuth flow. Attackers can forge ID tokens signed with the 'None' algorithm, enabling them to impersonate any user and potentially gain unauthorized access to sensitive resources or perform actions as legitimate users. This flaw could be exploited for account takeover, privilege escalation, or data theft.

CrowdSec has been tracking this vulnerability and its exploits since 12th of June 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-22893 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/api/auth/cognito/callback` endpoint by supplying a forged `id_token` JWT with the "none" algorithm, allowing them to bypass authentication and impersonate users in vulnerable Strapi instances.

## Timeline

- 2023-04-19: CVE Published. CVE-2023-22893 is published to NVD.
- 2025-06-12: Rule Released. CrowdSec releases a rule to detect CVE-2023-22893 exploitation attempts against the CrowdSec Network.
- 2025-06-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-22893 for the first time.

## References

- https://github.com/strapi/strapi/releases
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
- https://www.ghostccamm.com/blog/multi_strapi_vulns/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22893.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-22893) follows observed exploitation activity for CVE-2023-22893. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.