CVE-2025-25298
📋 TL;DR
Strapi versions before 5.10.3 do not enforce a maximum password length when using bcryptjs for password hashing, causing passwords longer than 72 bytes to be silently truncated. This reduces effective password entropy and could allow authentication with only the first 72 bytes of a longer password. All Strapi deployments using affected versions are vulnerable.
💻 Affected Systems
- Strapi
📦 What is this software?
Strapi by Strapi
⚠️ Risk & Real-World Impact
Worst Case
An attacker who obtains or guesses the first 72 bytes of a user's longer password could authenticate as that user, potentially gaining unauthorized access to sensitive CMS content or administrative functions.
Likely Case
Users with very long passwords may have reduced security without realizing it, and attackers could potentially brute-force the truncated portion more easily than the full password.
If Mitigated
With proper password policies and monitoring, the risk is minimal as attackers would still need to obtain the first 72 bytes of passwords.
🎯 Exploit Status
Exploitation requires either obtaining password hashes or guessing the first 72 bytes of user passwords.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.10.3
Vendor Advisory: https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3
Restart Required: No
Instructions:
1. Update Strapi to version 5.10.3 or later using npm: npm update @strapi/core 2. Verify the update completed successfully 3. Consider forcing password resets for users with very long passwords
🔧 Temporary Workarounds
Password Policy Enforcement
allImplement password policies that limit passwords to 72 characters or less
🧯 If You Can't Patch
- Implement password policies limiting passwords to 72 characters maximum
- Monitor authentication logs for unusual patterns and force password resets for users with very long passwords
🔍 How to Verify
Check if Vulnerable:
Check package.json for @strapi/core version. If version is less than 5.10.3, the system is vulnerable.Check Version:
npm list @strapi/coreVerify Fix Applied:
Verify @strapi/core version is 5.10.3 or higher in package.json and that password length validation is working.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful logins with similar but truncated credentials
- User accounts with extremely long passwords
Network Indicators:
- Unusual authentication patterns from single IP addresses
SIEM Query:
Authentication logs showing successful logins after multiple failures with similar credential patterns