CVE-2025-25298

Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.

• CWE-261

• https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cbPatch
• https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3Exploit, Vendor Advisory

Published

Oct 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25292ruby-saml provides security assertion markup language (SAML)…9.8
• CVE-2025-25293ruby-saml provides security assertion markup language (SAML)…7.5
• CVE-2025-25294Envoy Gateway is an open source project for managing Envoy P…5.3
• CVE-2025-25295Label Studio is an open source data labeling tool. A path tr…8.7
• CVE-2025-25296Label Studio is an open source data labeling tool. Prior to …6.1
• CVE-2025-25297Label Studio is an open source data labeling tool. Prior to …7.7
• CVE-2025-25299CKEditor 5 is a modern JavaScript rich-text editor with an M…2.3
• CVE-2025-2530Luxion KeyShot DAE File Parsing Access of Uninitialized Poin…7.8
• CVE-2025-25300smartbanner.js is a customizable smart app banner for iOS an…1.3
• CVE-2025-25301Rembg is a tool to remove images background. In Rembg 2.0.57…7.5
• CVE-2025-25302Rembg is a tool to remove images background. In Rembg 2.0.57…6.5
• CVE-2025-25303The MouseTooltipTranslator Chrome extension allows mouseover…6.9