CVE-2025-64526: strapi before 5.45.0 (exclusive), < 5.45.0; +1 more affected products

Affected technology

strapi · before 5.45.0 (exclusive)
strapi

strapi · < 5.45.0
strapi

@strapi/plugin-users-permissions · < 5.45.0
strapi

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker could include an arbitrary `email` value in the request body to obtain a fresh rate-limit key per request, effectively bypassing per-IP throttling on those routes and enabling high-volume credential brute-force, password-reset code brute-force, and credential-stuffing attempts. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as none; availability impact as low.