Executive brief
Strapi is an open-source headless CMS that manages user authentication and password storage. The password hashing mechanism using bcryptjs fails to validate maximum password length, allowing users to set passwords exceeding 72 bytes that get silently truncated. An attacker could potentially bypass authentication by logging in with only the first 72 characters of a longer password, and long passwords can degrade server performance.
Technical details
The vulnerability is a weak encoding weakness (CWE-261) in Strapi's user authentication system. The root cause is that Strapi's password hashing implementation using bcryptjs does not enforce a maximum password length validation, despite bcryptjs only considering the first 72 bytes of any password. This allows users to set passwords longer than 72 bytes, which are silently truncated during hashing. An attacker can exploit this by creating a user account with a long password (e.g., 85 characters) and then authenticating using only the first 72 characters, which will successfully match the truncated hash. No authentication is required to create a user account with a vulnerable password length. The fix, deployed in version 5.10.3, adds byte-length validation to enforce a maximum of 72 bytes during password creation and updates, and properly calculates byte length using TextEncoder to account for multi-byte UTF-8 characters.
Affected products
- Strapi @strapi/core all versions before 5.10.3
Timeline
- 2025-10-16: disclosed: Vulnerability published in GHSA-2cjv-6wg9-f4f3
- 2025-01-23: patched: Fix commit 41f8cdf applied, enforcing 72-byte maximum for password creation and updates