Rate-Limiting Bypass Vulnerability in Strapi Open Source CMS by Strapi

CVE-2025-64526

What is CVE-2025-64526?

Strapi, a popular open source headless content management system, contains a vulnerability in its users-permissions plugin affecting versions before 5.45.0. The rate-limit middleware incorrectly derives its key partially from user email in routes where the email field is not expected. This flaw allows an unauthenticated attacker to manipulate requests, generating unique rate-limit keys and effectively bypassing IP address restrictions. This makes it possible for attackers to launch brute-force attacks on user credentials and reset tokens by circumventing intended security measures. Strapi addressed this issue in version 5.45.0 by implementing an allow-list for valid routes that are supposed to utilize email, ensuring that other routes default to a secure identifier-less key to maintain effective throttling.

References