CVE-2025-25298
Missing Maximum Password Length Validation in Strapi Password Hashing
Description
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.
INFO
Published Date :
Oct. 16, 2025, 5:15 p.m.
Last Modified :
Oct. 19, 2026, 5:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update @strapi/core to version 5.10.3 or later.
- Review and enforce password length policies.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-25298.
| URL | Resource |
|---|---|
| https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb | Patch |
| https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3 | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-25298 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-25298
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-25298 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-25298 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 19, 2026
Action Type Old Value New Value Added Translation Title: Strapi, Description: Strapi es un CMS headless de código abierto. El paquete @strapi/core antes de la versión 5.10.3 no impone una longitud máxima de contraseña al usar bcryptjs para el hash de contraseñas. Bcryptjs ignora cualquier byte más allá de 72, por lo que las contraseñas de más de 72 bytes se truncan silenciosamente. Un usuario puede crear una cuenta con una contraseña que exceda los 72 bytes y luego autenticarse con solo los primeros 72 bytes. Esto reduce la entropía efectiva de las contraseñas excesivamente largas y puede engañar a los usuarios que creen que se requieren caracteres más allá de los 72 bytes, creando una baja probabilidad de autenticación no intencionada si un atacante puede obtener o adivinar la porción truncada. Las entradas largas de longitud excesiva también pueden imponer una sobrecarga de procesamiento innecesaria. El problema está solucionado en la versión 5.10.3. No existen soluciones alternativas conocidas. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'strapi', 'product': 'strapi', 'versions': [{'status': 'affected', 'version': '< 5.10.3'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-25298', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-10-16T18:08:48.659254Z'} -
Modified Analysis by [email protected]
Dec. 31, 2025
Action Type Old Value New Value Changed CPE Configuration OR *cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:* versions up to (excluding) 5.10.3 OR *cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* versions up to (excluding) 5.10.3 -
Initial Analysis by [email protected]
Nov. 25, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:* versions up to (excluding) 5.10.3 Added Reference Type GitHub, Inc.: https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb Types: Patch Added Reference Type GitHub, Inc.: https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3 Types: Exploit, Vendor Advisory -
New CVE Received by [email protected]
Oct. 16, 2025
Action Type Old Value New Value Added Description Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist. Added CVSS V4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-261 Added Reference https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb Added Reference https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3