Improper Restriction of Excessive Authentication Attempts in strapi - CVE-2025-64526

Detailed vulnerability description

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of excessive authentication attempts in the rate-limit middleware of the users-permissions plugin when handling authentication requests on routes that do not use an email field. A remote attacker can send crafted requests with arbitrary email values to bypass per-IP throttling and cause a denial of service.

The issue affects /auth/local, /auth/reset-password, and /auth/change-password, where the middleware derives part of the rate-limit key from an attacker-controlled email field that is outside the route contract.

How to mitigate CVE-2025-64526

Sources

• https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw