{"id":"CVE-2025-25298","aliases":["EUVD-2025-34776","GHSA-2cjv-6wg9-f4f3"],"status":"published","title":"Missing Maximum Password Length Validation in Strapi Password Hashing","description":"Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.004,"percentile":0.34708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-261"],"published":"2025-10-16T16:21:45Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"npm","package":"@strapi/core","fixed_in":["5.10.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@strapi/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@strapi/core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.10.3"}]}]}],"products":[{"vendor":"strapi","product":"strapi"}],"references":[{"url":"https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25298","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2cjv-6wg9-f4f3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25298.json","tags":["advisory"]},{"url":"https://github.com/strapi/strapi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-25298","title":"Missing Maximum Password Length Validation in Strapi Password Hashing","description":"Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.","status":"published","published":"2025-10-16T16:21:45.585Z","modified":"2025-10-16T18:12:49.837Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2025-34776","description":"Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.","status":"published","published":"2025-10-16T16:21:45Z","modified":"2025-10-16T18:12:49Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:31.065489Z"}],"ghsa":[{"id":"GHSA-2cjv-6wg9-f4f3","title":"Strapi Password Hashing is Missing Maximum Password Length Validation","description":"## Summary\n\nStrapi's password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation.\n\n## POC\nCreate an admin user with a password exceeding 72 characters like 85,\nLog in using only the first 72 characters of the password.\nAuthentication is successful, confirming the issue.\n\nProposed Solution Based on  discussions:\n\nAdd a maximum password length validation (72 characters) during password creation and updates for both Admin and U\u0026P users.\nTruncate passwords exceeding 72 bytes on the server before passing them to bcryptjs during login.\nOptionally, issue a warning to users with passwords longer than 72 bytes during login, informing them of truncation.\n\n## Impact\nThis issue affects all Strapi installations using bcryptjs for password hashing. Until resolved, it can lead to:\nAuthentication Bypass: Users may unknowingly set passwords exceeding 72 bytes, leading to truncated, predictable hashes.\nPerformance Issues: Excessively long passwords can degrade server performance.","status":"published","published":"2025-10-16T18:41:43Z","modified":"2025-11-27T08:45:00Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T14:39:10.178331Z"}],"nvd":[{"id":"CVE-2025-25298","description":"Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.","status":"published","published":"2025-10-16T17:15:33.353Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-25298","title":"Missing Maximum Password Length Validation in Strapi Password Hashing","description":"Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.","status":"published","published":"2025-10-16T16:21:45.585Z","modified":"2026-10-28T02:30:57.661049926Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"GHSA-2cjv-6wg9-f4f3","title":"Strapi Password Hashing is Missing Maximum Password Length Validation","description":"## Summary\n\nStrapi's password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation.\n\n## POC\nCreate an admin user with a password exceeding 72 characters like 85,\nLog in using only the first 72 characters of the password.\nAuthentication is successful, confirming the issue.\n\nProposed Solution Based on  discussions:\n\nAdd a maximum password length validation (72 characters) during password creation and updates for both Admin and U\u0026P users.\nTruncate passwords exceeding 72 bytes on the server before passing them to bcryptjs during login.\nOptionally, issue a warning to users with passwords longer than 72 bytes during login, informing them of truncation.\n\n## Impact\nThis issue affects all Strapi installations using bcryptjs for password hashing. Until resolved, it can lead to:\nAuthentication Bypass: Users may unknowingly set passwords exceeding 72 bytes, leading to truncated, predictable hashes.\nPerformance Issues: Excessively long passwords can degrade server performance.","status":"published","published":"2025-10-16T18:41:43Z","modified":"2025-11-27T09:11:22.621037Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}