Strapi CVE-2025-25298

Exploitation requires a specific non-default precondition: a target admin or users-permissions account must have been created or updated with a password longer than 72 bytes, so that bcryptjs truncation discards the trailing bytes. The attacker must then obtain or correctly guess the first 72 bytes of that password. Limiting factors that reduce realistic risk: passwords exceeding 72 bytes are uncommon in practice, the entropy reduction only matters when the truncated prefix is itself weak or known, and the attacker gains no advantage unless they already possess most of the credential - reflected in the AC:H (high complexity) metric. A secondary condition is that overlong inputs can impose unnecessary bcrypt processing overhead regardless of authentication outcome.

This is a genuine but low-severity design weakness rather than a high-priority threat. The CVSS 4.0 base score of 6.3 (Medium) is driven by AV:N (network) but tempered by AC:H (high attack complexity) and limited to VC:L (low confidentiality impact), with no integrity (VI:N) or availability (VA:N) impact. The flaw is that @strapi/core <5.10.3 relies on bcryptjs, which silently truncates passwords beyond 72 bytes, so entropy from longer passwords is lost. Although the CVSS vector shows PR:N (unauthenticated), real exploitation is heavily gated: a victim must first have chosen a password exceeding 72 bytes, and an attacker must independently obtain or guess the first 72 bytes - the AC:H metric correctly reflects these compounding preconditions. Publicly available exploit code exists (a GHSA proof-of-concept demonstrating the truncation), but this is a demonstration of the truncation behavior, not a weaponized authentication-bypass tool, and POC availability must not be conflated with active exploitation. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of real-world exploitation or high predicted exploitation probability. No SSVC data was supplied. On balance the signals are consistent and point the same direction: a legitimate hardening issue with marginal practical risk, not an urgent emergency.

A Strapi administrator or user, believing longer passwords are stronger, sets a password exceeding 72 bytes; bcryptjs silently truncates it to the first 72 bytes during hashing. An attacker who knows or can guess only the first 72 bytes can then authenticate successfully, as demonstrated by the publicly available GHSA proof-of-concept (create an 85-character password, log in with the first 72). The practical likelihood is low because it depends on users choosing unusually long passwords and the attacker already possessing most of the credential.