Password Handling Vulnerability in Strapi Core Package Affects Authentication Process

CVE-2025-25298

What is CVE-2025-25298?

A vulnerability in the @strapi/core package allows users to create accounts with passwords exceeding 72 bytes, which are then truncated without warning during authentication. As the bcryptjs library ignores bytes beyond this limit, users may believe that their entire password is necessary, while in actuality, only the first 72 bytes are used. This not only reduces the effective security of their passwords but also poses risks of potential unauthorized access, as attackers could exploit the truncated portion. The issue has been addressed in version 5.10.3, with no available workarounds.

References