CVE-2025-25298: strapi — Exploit & Fix

Description

Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.

Is your site exposed to CVE-2025-25298?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-261 CWE-261

Affected Products

Vendor	Product	Versions
strapi	strapi	< 5.10.3

References

Advisories & Patches

https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3

Exploits

https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3

Frequently Asked Questions

What is CVE-2025-25298? +

Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2025-25298? +

CVE-2025-25298 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-25298? +

CVE-2025-25298 affects products from strapi, specifically: strapi. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-25298? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-7407

Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, …

CVE-2025-11155

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is …

CVE-2024-5434

The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within …

CVE-2026-25607

Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after …

CVE-2025-31229 9.1

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may …

CVE-2024-45394 8.8

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data …

CVE-2025-25298