SB2026051395 - Improper Restriction of Excessive Authentication Attempts in strapi

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2025-64526)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of excessive authentication attempts in the rate-limit middleware of the users-permissions plugin when handling authentication requests on routes that do not use an email field. A remote attacker can send crafted requests with arbitrary email values to bypass per-IP throttling and cause a denial of service.

The issue affects /auth/local, /auth/reset-password, and /auth/change-password, where the middleware derives part of the rate-limit key from an attacker-controlled email field that is outside the route contract.

Remediation

Install update from vendor's website.

References

• https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw