CVE-2025-25298: Missing Maximum Password Length Validation in Strapi Password Hashing
Summary
Strapi's password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation.
POC Create an admin user with a password exceeding 72 characters like 85, Log in using only the first 72 characters of the password. Authentication is successful, confirming the issue.
Proposed Solution Based on discussions:
Add a maximum password length validation (72 characters) during password creation and updates for both Admin and U&P users. Truncate passwords exceeding 72 bytes on the server before passing them to bcryptjs during login. Optionally, issue a warning to users with passwords longer than 72 bytes during login, informing them of truncation.
Impact This issue affects all Strapi installations using bcryptjs for password hashing. Until resolved, it can lead to: Authentication Bypass: Users may unknowingly set passwords exceeding 72 bytes, leading to truncated, predictable hashes. Performance Issues: Excessively long passwords can degrade server performance.
Other sources
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25298?
CVE-2025-25298 has a moderate severity as it allows for the truncation of passwords longer than 72 bytes.
How do I fix CVE-2025-25298?
To fix CVE-2025-25298, update the @strapi/core package to version 5.10.3 or later.
What type of vulnerability is associated with CVE-2025-25298?
CVE-2025-25298 is a password truncation vulnerability due to the lack of maximum password length enforcement.
Which versions of Strapi are affected by CVE-2025-25298?
CVE-2025-25298 affects all versions of the @strapi/core package prior to 5.10.3.
What is the impact of exploiting CVE-2025-25298?
Exploiting CVE-2025-25298 can lead to security risks due to users' passwords being silently truncated, potentially compromising user accounts.