Strapi up to 5.10.2 weak password encoding

Summaryinfo

A vulnerability categorized as problematic has been discovered in Strapi up to 5.10.2. This vulnerability affects unknown code. Such manipulation leads to weak password encoding. This vulnerability is documented as CVE-2025-25298. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Strapi up to 5.10.2. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a weak password encoding vulnerability. Using CWE to declare the problem leads to CWE-261. Obscuring a password with a trivial encoding does not protect the password. Impacted is confidentiality. CVE summarizes:

Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-25298 since 02/06/2025. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

Upgrading to version 5.10.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-34776) and CERT Bund (WID-SEC-2025-2332). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source Strapi

Productinfo

Name

• Strapi

Version

• 5.10.0
• 5.10.1
• 5.10.2

Website

• Product: https://github.com/strapi/strapi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion