CVE-2025-22228

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-22237.8CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering CVE-2025-222307.8VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administ CVE-2025-222317.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escal CVE-2025-222325.3Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your applica CVE-2025-222333.1CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter CVE-2025-222345.3The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow CVE-2025-222357.3EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or CVE-2025-222368.1Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on oth CVE-2025-222376.7An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause CVE-2025-222384.2Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which co CVE-2025-222398.1Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events CVE-2025-22245.3The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access