CVE-2025-25298: Strapi Authentication Bypass Vulnerability

CVE-2025-25298 Overview

Strapi is an open source headless content management system (CMS). The @strapi/core package before version 5.10.3 fails to enforce a maximum password length when hashing credentials with bcryptjs. Because bcryptjs silently ignores any input bytes beyond 72, passwords longer than 72 bytes are truncated during hashing. A user who creates an account with a password exceeding 72 bytes can later authenticate using only the first 72 bytes. This weakens the effective entropy of overlong passwords and may mislead users who assume trailing characters contribute to security. The issue is tracked under [CWE-261] and is fixed in version 5.10.3.

Critical Impact
Authenticated users can log in with only the first 72 bytes of their chosen password, reducing effective password entropy and enabling potential unintended authentication if an attacker guesses or obtains the truncated prefix.

Affected Products

Strapi @strapi/core versions prior to 5.10.3
Strapi self-hosted deployments using bcryptjs password hashing
Strapi admin panel and user registration/reset password flows

Discovery Timeline

2025-10-16 - CVE-2025-25298 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25298

Vulnerability Analysis

The vulnerability originates in the password handling pipeline of @strapi/core. Strapi uses the bcryptjs library to hash user passwords, but the library enforces a hard 72-byte input limit inherited from the underlying bcrypt algorithm. When Strapi passes a password longer than 72 bytes to bcryptjs, the library silently truncates the input rather than raising an error. Strapi did not validate password byte length prior to hashing, so long passwords were accepted at registration and reset, then hashed against only the first 72 bytes.

During authentication, the same truncation applies. A supplied password matches the stored hash as long as its first 72 bytes are identical to the original. Any value beyond byte 72 is effectively ignored, which contradicts user expectations for long passphrases and may cause password entropy to be lower than intended.

Root Cause

The root cause is missing input validation on password length in bytes. The registration and password reset components did not test the UTF-8 byte size of the password against bcryptjs's 72-byte capacity. Multi-byte characters make character-based length checks insufficient, since a single Unicode character can consume multiple bytes.

Attack Vector

Exploitation requires an attacker to obtain or guess the first 72 bytes of a target user's password. Because network attack complexity is high and no privileges are required, the exposure is remote but constrained. Users who deliberately chose long passphrases for high-entropy protection are the most affected, since the security assumption of their full-length password is not honored.

typescript

// Patch: packages/core/admin/admin/src/pages/Auth/components/ResetPassword.tsx
       defaultMessage: 'Password must be at least 8 characters',
       values: { min: 8 },
     })
-    .test(
-      'required-byte-size',
-      'Password must be between 8 and 70 bytes',
-      (value) => {
-        if (!value) return false;
-        const byteSize = new TextEncoder().encode(value).length;
-        return byteSize >= 8 && byteSize <= 70;
-      }
-    )
+    // bcrypt has a max length of 72 bytes (not characters!)
+    .test('required-byte-size', 'Password must be less than 73 bytes', (value) => {
+      if (!value) return false;
+      const byteSize = new TextEncoder().encode(value).length;
+      return byteSize <= 72;
+    })
     .matches(/[a-z]/, {
       message: {
         id: 'components.Input.error.contain.lowercase',

Source: Strapi GitHub commit 41f8cdf. The patch replaces character-based validation with byte-size validation using TextEncoder, ensuring inputs are rejected before reaching bcryptjs.

Detection Methods for CVE-2025-25298

Indicators of Compromise

Multiple failed authentication attempts followed by success where submitted password length exceeds 72 bytes
Registration or password-reset audit logs showing password field payloads larger than 72 bytes on vulnerable Strapi versions
Unexpected authentication events from IP addresses that previously failed against long-password accounts

Detection Strategies

Inventory all Strapi deployments and compare @strapi/core package versions against the fixed release 5.10.3
Review web server and reverse proxy logs for POST requests to /admin/register-admin, /admin/register, and /admin/reset-password endpoints with large password payloads
Correlate administrator account creation events with subsequent login patterns to detect anomalous access

Monitoring Recommendations

Ingest Strapi admin panel authentication logs into a centralized SIEM and alert on brute-force patterns against admin accounts
Monitor for outbound anomalies from Strapi hosts that may indicate post-authentication abuse
Track dependency manifests in CI/CD pipelines to flag any regression to pre-5.10.3 versions of @strapi/core

How to Mitigate CVE-2025-25298

Immediate Actions Required

Upgrade @strapi/core to version 5.10.3 or later across all Strapi environments
Force password resets for admin accounts that used passwords longer than 72 bytes to remove ambiguity about their effective secret
Enable multi-factor authentication on Strapi admin accounts to reduce exposure from any weakened credentials
Audit registration and reset endpoints for anomalous activity prior to the upgrade

Patch Information

The fix is available in Strapi @strapi/core version 5.10.3. Reference the Strapi Security Advisory GHSA-2cjv-6wg9-f4f3 and the upstream commit 41f8cdf for implementation details. The patch adds a TextEncoder-based byte-size test that rejects passwords exceeding 72 bytes in both the Register and ResetPassword components.

Workarounds

No official workarounds exist per the vendor advisory; upgrading to 5.10.3 is the only supported remediation
As a defense-in-depth measure, place a web application firewall (WAF) rule to reject registration and reset requests whose password field exceeds 72 bytes
Communicate to end users that password entropy beyond 72 bytes is not enforced on unpatched versions

bash

# Upgrade Strapi core to the fixed version
npm install @strapi/core@5.10.3 --save

# Verify installed version
npm ls @strapi/core

# Rebuild and restart the Strapi application
npm run build
npm run start