npm/@strapi/plugin-users-permissions

Strapi Improper Rate Limiting vulnerability

Modified: 9/10/2026

Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

Modified: 11/8/2023

Strapi does not verify the access or ID tokens issued during the OAuth flow

Modified: 11/8/2023

Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

Modified: 5/16/2026

Unauthorized Access to Private Fields in User Registration API

Modified: 11/8/2023

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

Modified: 5/16/2026

@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass

Modified: 9/10/2026

Authentication Bypass in @strapi/plugin-users-permissions

Modified: 4/18/2023