CVE-2023-22893

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

• CWE-287
• CWE-287

• https://github.com/strapi/strapi/releasesRelease Notes
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cveExploit, Vendor Advisory
• https://www.ghostccamm.com/blog/multi_strapi_vulns/Exploit, Third Party Advisory
• https://github.com/strapi/strapi/releasesRelease Notes
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cveExploit, Vendor Advisory
• https://www.ghostccamm.com/blog/multi_strapi_vulns/Exploit, Third Party Advisory

Published

Apr 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22888Apache Airflow, versions before 2.6.3, is affected by a vuln…6.5
• CVE-2023-22889SmartBear Zephyr Enterprise through 7.15.0 mishandles user-d…9.8
• CVE-2023-2289The wordpress vertical image slider plugin for WordPress is …6.1
• CVE-2023-22890SmartBear Zephyr Enterprise through 7.15.0 allows unauthenti…7.5
• CVE-2023-22891There exists a privilege escalation vulnerability in SmartBe…8.1
• CVE-2023-22892There exists an information disclosure vulnerability in Smar…7.5
• CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the ad…4.9
• CVE-2023-22895The bzip2 crate before 0.4.4 for Rust allow attackers to cau…7.5
• CVE-2023-22897An issue was discovered in SecurePoint UTM before 12.2.5.1. …6.5
• CVE-2023-22898workers/extractor.py in Pandora (aka pandora-analysis/pandor…6.5
• CVE-2023-22899Zip4j through 2.11.2, as used in Threema and other products,…5.9
• CVE-2023-2290A potential vulnerability in the LenovoFlashDeviceInterface …6.7