CVE-2023-38492: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities.

Kirby's authentication endpoint did not limit the password length. This allowed attackers to provide a password with a length up to the server's maximum request body length. Validating that password against the user's actual password requires hashing the provided password, which requires more CPU and memory resources (and therefore processing time) the longer the provided password gets. This could be abused by an attacker to cause the website to become unresponsive or unavailable. Because Kirby comes with a built-in brute force protection, the impact of this vulnerability is limited to 10 failed logins from each IP address and 10 failed logins for each existing user per hour.

The problem has been patched in Kirby 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. In all of the mentioned releases, the maintainers have added password length limits in the affected code so that passwords longer than 1000 bytes are immediately blocked, both when setting a password and when logging in.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2023-07-27T16:15Z
Repository: https://github.com/getkirby/kirby
Language: JSON
Files changed: i18n/translations/bg.json, i18n/translations/ca.json, i18n/translations/cs.json, i18n/translations/da.json, i18n/translations/de.json, i18n/translations/el.json, i18n/translations/en.json, i18n/translations/eo.json, i18n/translations/es_419.json, i18n/translations/es_ES.json, i18n/translations/fa.json, i18n/translations/fi.json, i18n/translations/fr.json, i18n/translations/hu.json, i18n/translations/id.json, i18n/translations/is_IS.json, i18n/translations/it.json, i18n/translations/ko.json, i18n/translations/lt.json, i18n/translations/nb.json, i18n/translations/nl.json, i18n/translations/pl.json, i18n/translations/pt_BR.json, i18n/translations/pt_PT.json, i18n/translations/ro.json, i18n/translations/ru.json, i18n/translations/sk.json, i18n/translations/sv_SE.json, i18n/translations/tr.json, src/Cms/User.php, src/Cms/UserRules.php, tests/Cms/Users/UserRulesTest.php, tests/Cms/Users/UserTest.php
Commit date: 2023-07-26 21:17:20 +0200
Commit message: Fix password length vulnerability

https://github.com/getkirby/kirby/security/advisories/GHSA-3v6j-v3qc-cxff

Diff: diff --git a/i18n/translations/bg.json b/i18n/translations/bg.json
index e384e9f0e..e0f2833dd 100644
--- a/i18n/translations/bg.json
+++ b/i18n/translations/bg.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "\u041d\u0435 \u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0435\u043d\u043e \u0434\u0430 \u0438\u0437\u0442\u0440\u0438\u0432\u0430\u0442\u0435 \u0442\u043e\u0437\u0438 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b",
 	"error.user.duplicate": "Потребител с имейл \"{email}\" вече съществува",
 	"error.user.email.invalid": "Моля въведете валиден email адрес",
 	"error.user.language.invalid": "Моля въведете валиден език",
 	"error.user.notFound": "\u041f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044f\u0442 \u043d\u0435 \u043c\u043e\u0436\u0435 \u0434\u0430 \u0431\u044a\u0434\u0435 \u043d\u0430\u043c\u0435\u0440\u0435\u043d.",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Моля въведете валидна парола. Тя трабва да съдържа поне 8 символа.",
 	"error.user.password.notSame": "\u041c\u043e\u043b\u044f, \u043f\u043e\u0442\u0432\u044a\u0440\u0434\u0435\u0442\u0435 \u043f\u0430\u0440\u043e\u043b\u0430\u0442\u0430",
 	"error.user.password.undefined": "Потребителят няма парола",
 	"error.user.password.wrong": "Wrong password",
 	"error.user.role.invalid": "Моля въведете валидна роля",
diff --git a/i18n/translations/ca.json b/i18n/translations/ca.json
index 33fb1e7ae..a8d0f6c37 100644
--- a/i18n/translations/ca.json
+++ b/i18n/translations/ca.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "No pots eliminar l'usuari \"{name}\"",
 	"error.user.duplicate": "Ja existeix un usuari amb l'adreça electrònica \"{email}\"",
 	"error.user.email.invalid": "Si us plau, introdueix una adreça de correu electrònic vàlida",
 	"error.user.language.invalid": "Introduïu un idioma vàlid",
 	"error.user.notFound": "L'usuari \"{name}\" no s'ha trobat",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Introduïu una contrasenya vàlida. Les contrasenyes han de tenir com a mínim 8 caràcters.",
 	"error.user.password.notSame": "Les contrasenyes no coincideixen",
 	"error.user.password.undefined": "L'usuari no té una contrasenya",
 	"error.user.password.wrong": "Wrong password",
 	"error.user.role.invalid": "Si us plau, introdueix un rol vàlid",
diff --git a/i18n/translations/cs.json b/i18n/translations/cs.json
index d2db566de..9d8876c98 100644
--- a/i18n/translations/cs.json
+++ b/i18n/translations/cs.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Nem\u00e1te dovoleno smazat tohoto u\u017eivatele",
 	"error.user.duplicate": "Uživatel s emailovou adresou \"{email}\" již existuje",
 	"error.user.email.invalid": "Zadejte prosím platnou emailovou adresu",
 	"error.user.language.invalid": "Zadejte prosím platný jazyk",
 	"error.user.notFound": "U\u017eivatele se nepoda\u0159ilo nal\u00e9zt",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Zadejte prosím platné heslo. Heslo musí být dlouhé alespoň 8 znaků.",
 	"error.user.password.notSame": "Pros\u00edm potvr\u010fte heslo",
 	"error.user.password.undefined": "Uživatel nemá nastavené heslo.",
 	"error.user.password.wrong": "Špatné heslo",
 	"error.user.role.invalid": "Zadejte prosím platnou roli",
diff --git a/i18n/translations/da.json b/i18n/translations/da.json
index 540a6b61a..2fc7c5cc9 100644
--- a/i18n/translations/da.json
+++ b/i18n/translations/da.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Du har ikke tilladelse til at slette denne bruger",
 	"error.user.duplicate": "En bruger med email adresse \"{email}\" eksisterer allerede",
 	"error.user.email.invalid": "Indtast venligst en gyldig email adresse",
 	"error.user.language.invalid": "Indtast venligst et gyldigt sprog",
 	"error.user.notFound": "Brugeren kunne ikke findes",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Indtast venligst en gyldig adgangskode. Adgangskoder skal minimum være 8 tegn lange.",
 	"error.user.password.notSame": "Bekr\u00e6ft venligst adgangskoden",
 	"error.user.password.undefined": "Brugeren har ikke en adgangskode",
 	"error.user.password.wrong": "Forkert adgangskode",
 	"error.user.role.invalid": "Indtast venligst en gyldig rolle",
diff --git a/i18n/translations/de.json b/i18n/translations/de.json
index 17a283c4d..eec3033f4 100644
--- a/i18n/translations/de.json
+++ b/i18n/translations/de.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Du darfst den Account \"{name}\" nicht löschen",
 	"error.user.duplicate": "Ein Account mit der E-Mailadresse \"{email}\" besteht bereits",
 	"error.user.email.invalid": "Bitte gib eine gültige E-Mailadresse an",
 	"error.user.language.invalid": "Bitte gib eine gültige Sprache an",
 	"error.user.notFound": "Der Account \"{name}\" wurde nicht gefunden",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Bitte gib ein gültiges Passwort ein. Passwörter müssen mindestens 8 Zeichen lang sein.",
 	"error.user.password.notSame": "Die Passwörter stimmen nicht überein",
 	"error.user.password.undefined": "Der Account hat kein Passwort",
 	"error.user.password.wrong": "Falsches Passwort",
 	"error.user.role.invalid": "Bitte gib eine gültige Rolle an",
diff --git a/i18n/translations/el.json b/i18n/translations/el.json
index f55b00fa2..75b5ab654 100644
--- a/i18n/translations/el.json
+++ b/i18n/translations/el.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Δεν επιτρέπεται να διαγράψετ τον χρήστη \"{name}\"",
 	"error.user.duplicate": "Ένας χρήστης με τη διεύθυνση ηλεκτρονικού ταχυδρομείου \"{email}\" υπάρχει ήδη",
 	"error.user.email.invalid": "Παρακαλώ εισάγετε μια έγκυρη διεύθυνση ηλεκτρονικού ταχυδρομείου",
 	"error.user.language.invalid": "Παρακαλώ εισαγάγετε μια έγκυρη γλώσσα",
 	"error.user.notFound": "Δεν είναι δυνατή η εύρεση του χρήστη \"{name}\"",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Παρακαλώ εισάγετε έναν έγκυρο κωδικό πρόσβασης. Οι κωδικοί πρόσβασης πρέπει να έχουν μήκος τουλάχιστον 8 χαρακτήρων.",
 	"error.user.password.notSame": "\u03a0\u03b1\u03c1\u03b1\u03ba\u03b1\u03bb\u03bf\u03cd\u03bc\u03b5 \u03b5\u03c0\u03b9\u03b2\u03b5\u03b2\u03b1\u03b9\u03ce\u03c3\u03c4\u03b5 \u03c4\u03bf\u03bd \u039a\u03c9\u03b4\u03b9\u03ba\u03cc \u03a0\u03c1\u03cc\u03c3\u03b2\u03b1\u03c3\u03b7\u03c2",
 	"error.user.password.undefined": "Ο χρήστης δεν έχει κωδικό πρόσβασης",
 	"error.user.password.wrong": "Wrong password",
 	"error.user.role.invalid": "Παρακαλώ εισαγάγετε έναν έγκυρο ρόλο",
diff --git a/i18n/translations/en.json b/i18n/translations/en.json
index 06f93e696..30464d535 100644
--- a/i18n/translations/en.json
+++ b/i18n/translations/en.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "You are not allowed to delete the user \"{name}\"",
 	"error.user.duplicate": "A user with the email address \"{email}\" already exists",
 	"error.user.email.invalid": "Please enter a valid email address",
 	"error.user.language.invalid": "Please enter a valid language",
 	"error.user.notFound": "The user \"{name}\" cannot be found",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Please enter a valid password. Passwords must be at least 8 characters long.",
 	"error.user.password.notSame": "The passwords do not match",
 	"error.user.password.undefined": "The user does not have a password",
 	"error.user.password.wrong": "Wrong password",
 	"error.user.role.invalid": "Please enter a valid role",
diff --git a/i18n/translations/eo.json b/i18n/translations/eo.json
index 8d0ee2544..0ee83fc74 100644
--- a/i18n/translations/eo.json
+++ b/i18n/translations/eo.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Vi ne rajtas forigi la uzanton \"{name}\"",
 	"error.user.duplicate": "Jam ekzistas uzanto kies retpoŝtadreso estas \"{email}\"",
 	"error.user.email.invalid": "Bonvolu entajpi validan retpoŝtadreson",
 	"error.user.language.invalid": "Bonvolu entajpi validan lingvon",
 	"error.user.notFound": "La uzanto \"{name}\" ne troveblas",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Bonvolu entajpi validan pasvorton. Pasvortoj devas esti almenaŭ 8 literojn longaj.",
 	"error.user.password.notSame": "La pasvortoj ne estas kongruantaj",
 	"error.user.password.undefined": "La uzanto ne havas pasvorton",
 	"error.user.password.wrong": "Malĝusta pasvorto",
 	"error.user.role.invalid": "Bonvolu entajpi validan rolon",
diff --git a/i18n/translations/es_419.json b/i18n/translations/es_419.json
index dc0b07efd..29f6c6d5c 100644
--- a/i18n/translations/es_419.json
+++ b/i18n/translations/es_419.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Usted no tiene permitido borrar este usuario",
 	"error.user.duplicate": "Ya existe un usuario con el email \"{email}\"",
 	"error.user.email.invalid": "Por favor ingresa un correo electrónico valido",
 	"error.user.language.invalid": "Por favor ingresa un idioma valido",
 	"error.user.notFound": "El usuario no pudo ser encontrado",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Por favor ingresa una contraseña valida. Las contraseñas deben tener al menos 8 caracteres de largo.",
 	"error.user.password.notSame": "Por favor confirma la contrase\u00f1a",
 	"error.user.password.undefined": "El usuario no tiene contraseña",
 	"error.user.password.wrong": "Contraseña incorrecta",
 	"error.user.role.invalid": "Por favor ingresa un rol valido",
diff --git a/i18n/translations/es_ES.json b/i18n/translations/es_ES.json
index 134b2f078..c9b407f3b 100644
--- a/i18n/translations/es_ES.json
+++ b/i18n/translations/es_ES.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "No tienes permiso para eliminar el usuario \"{name}\"",
 	"error.user.duplicate": "Un usuario con la dirección de correo electrónico \"{email}\" ya existe",
 	"error.user.email.invalid": "Por favor, introduce una dirección de correo electrónico válida",
 	"error.user.language.invalid": "Por favor, introduce un idioma válido",
 	"error.user.notFound": "No se puede encontrar el usuario \"{name}\"",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Por favor, introduce una contraseña válida. Las contraseñas deben tener al menos 8 caracteres de largo.",
 	"error.user.password.notSame": "Las contraseñas no coinciden",
 	"error.user.password.undefined": "El usuario no tiene contraseña",
 	"error.user.password.wrong": "Contraseña incorrecta",
 	"error.user.role.invalid": "Por favor, introduce un rol válido",
diff --git a/i18n/translations/fa.json b/i18n/translations/fa.json
index 8e71cdf19..74a5cdec3 100644
--- a/i18n/translations/fa.json
+++ b/i18n/translations/fa.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "شما اجازه حذف کاربر «{name}» را ندارید",
 	"error.user.duplicate": "کاربری با ایمیل «{email}» هم اکنون موجود است",
 	"error.user.email.invalid": "لطفا یک ایمیل معتبر وارد کنید",
 	"error.user.language.invalid": "لطفا زبان معتبری انتخاب کنید",
 	"error.user.notFound": "کاربر «{name}» پیدا نشد",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "لطفا گذرواژه صحیحی با حداقل طول 8 حرف وارد کنید. ",
 	"error.user.password.notSame": "\u0644\u0637\u0641\u0627 \u062a\u06a9\u0631\u0627\u0631 \u06af\u0630\u0631\u0648\u0627\u0698\u0647 \u0631\u0627 \u0648\u0627\u0631\u062f \u0646\u0645\u0627\u06cc\u06cc\u062f",
 	"error.user.password.undefined": "کاربر فاقد گذرواژه است",
 	"error.user.password.wrong": "Wrong password",
 	"error.user.role.invalid": "لطفا نقش صحیحی وارد نمایید",
diff --git a/i18n/translations/fi.json b/i18n/translations/fi.json
index 3d29c0eb8..d6adfafe5 100644
--- a/i18n/translations/fi.json
+++ b/i18n/translations/fi.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Sinulla ei ole oikeutta poistaa käyttäjää \"{name}\"",
 	"error.user.duplicate": "Käyttäjä, jonka sähköpostiosoite on \"{name}\", on jo olemassa",
 	"error.user.email.invalid": "Anna kelpaava sähköpostiosoite",
 	"error.user.language.invalid": "Anna kelpaava kieli",
 	"error.user.notFound": "K\u00e4ytt\u00e4j\u00e4\u00e4 ei l\u00f6ytynyt",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Anna kelpaava salasana. Salasanan täytyy olla ainakin 8 merkkiä pitkä.",
 	"error.user.password.notSame": "Salasanat eivät täsmää",
 	"error.user.password.undefined": "Käyttäjällä ei ole salasanaa",
 	"error.user.password.wrong": "Väärä salasana",
 	"error.user.role.invalid": "Anna kelpaava käyttäjätaso",
diff --git a/i18n/translations/fr.json b/i18n/translations/fr.json
index 41bd2a01d..78819b6e4 100644
--- a/i18n/translations/fr.json
+++ b/i18n/translations/fr.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Vous n’êtes pas autorisé à supprimer l’utilisateur « {name} »",
 	"error.user.duplicate": "Un utilisateur avec le courriel « {email} » existe déjà",
 	"error.user.email.invalid": "Veuillez saisir un courriel valide",
 	"error.user.language.invalid": "Veuillez saisir une langue valide",
 	"error.user.notFound": "L’utilisateur « {name} » n’a pu être trouvé",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Veuillez saisir un mot de passe valide. Les mots de passe doivent comporter au moins 8 caractères.",
 	"error.user.password.notSame": "Les mots de passe ne sont pas identiques",
 	"error.user.password.undefined": "Cet utilisateur n’a pas de mot de passe",
 	"error.user.password.wrong": "Mot de passe incorrect",
 	"error.user.role.invalid": "Veuillez saisir un rôle valide",
diff --git a/i18n/translations/hu.json b/i18n/translations/hu.json
index 9a3f10864..fe5573e6d 100644
--- a/i18n/translations/hu.json
+++ b/i18n/translations/hu.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Nincs jogosults\u00e1god t\u00f6r\u00f6lni ezt a felhaszn\u00e1l\u00f3t",
 	"error.user.duplicate": "Már létezik felhasználó \"{email}\" email-címmel",
 	"error.user.email.invalid": "Kérlek adj meg egy valós email-címet",
 	"error.user.language.invalid": "Kérlek add meg a megfelelő nyelvi beállítást",
 	"error.user.notFound": "A felhaszn\u00e1l\u00f3 nem tal\u00e1lhat\u00f3",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Kérlek adj meg egy megfelelő jelszót. A jelszónak legalább 8 karakter hosszúságúnak kell lennie.",
 	"error.user.password.notSame": "K\u00e9rlek er\u0151s\u00edtsd meg a jelsz\u00f3t",
 	"error.user.password.undefined": "A felhasználónak nincs jelszó megadva",
 	"error.user.password.wrong": "Hibás jelszó",
 	"error.user.role.invalid": "Kérlek adj meg egy megfelelő szerepkört",
diff --git a/i18n/translations/id.json b/i18n/translations/id.json
index e6b4b88a4..39352bc37 100644
--- a/i18n/translations/id.json
+++ b/i18n/translations/id.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Anda tidak diizinkan menghapus pengguna \"{name}\"",
 	"error.user.duplicate": "Pengguna dengan surel \"{email}\" sudah ada",
 	"error.user.email.invalid": "Masukkan surel yang valid",
 	"error.user.language.invalid": "Masukkan bahasa yang valid",
 	"error.user.notFound": "Pengguna \"{name}\" tidak dapat ditemukan",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Masukkan sandi yang valid. Sandi setidaknya mengandung 8 karakter.",
 	"error.user.password.notSame": "Sandi tidak cocok",
 	"error.user.password.undefined": "Pengguna tidak memiliki sandi",
 	"error.user.password.wrong": "Kata sandi salah",
 	"error.user.role.invalid": "Masukkan peran yang valid",
diff --git a/i18n/translations/is_IS.json b/i18n/translations/is_IS.json
index f1d63caf4..6d8325693 100644
--- a/i18n/translations/is_IS.json
+++ b/i18n/translations/is_IS.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Þú mátt ekkert eyða notandanum \"{name}\"",
 	"error.user.duplicate": "Nú þegar finnst notandi með þetta netfang: \"{email}\"",
 	"error.user.email.invalid": "Vinsamlegast ákjósanlegt netfang",
 	"error.user.language.invalid": "Vinsamlegast ákjósanlegt tungumál",
 	"error.user.notFound": "Þessi notandi; \"{name}\" fannst ekki",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Veldu ákjósanlegt lykilorð. Minnst 8 stafa langt.",
 	"error.user.password.notSame": "Lykilorðin stemma ekki",
 	"error.user.password.undefined": "Þessi notandi hefur ekki lykilorð",
 	"error.user.password.wrong": "Rangt lykilorð",
 	"error.user.role.invalid": "Veldu ákjósanlegt hlutverk",
diff --git a/i18n/translations/it.json b/i18n/translations/it.json
index 234eb2f00..acaf510cf 100644
--- a/i18n/translations/it.json
+++ b/i18n/translations/it.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Non ti \u00e8 permesso eliminare questo utente ",
 	"error.user.duplicate": "Esiste già un utente con l'indirizzo email \"{email}\"",
 	"error.user.email.invalid": "Inserisci un indirizzo email valido",
 	"error.user.language.invalid": "Inserisci una lingua valida",
 	"error.user.notFound": "L'utente non \u00e8 stato trovato",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Per favore inserisci una password valida. Le password devono essere lunghe almeno 8 caratteri",
 	"error.user.password.notSame": "Le password non corrispondono",
 	"error.user.password.undefined": "L'utente non ha una password",
 	"error.user.password.wrong": "Password sbagliata",
 	"error.user.role.invalid": "Inserisci un ruolo valido",
diff --git a/i18n/translations/ko.json b/i18n/translations/ko.json
index a453238c4..0084272c6 100644
--- a/i18n/translations/ko.json
+++ b/i18n/translations/ko.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "사용자({name})를 삭제할 권한이 없습니다.",
 	"error.user.duplicate": "이메일 주소({email})가 같은 사용자가 있습니다.",
 	"error.user.email.invalid": "올바른 이메일 주소를 입력하세요.",
 	"error.user.language.invalid": "올바른 언어를 입력하세요.",
 	"error.user.notFound": "사용자({name})가 없습니다.",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "암호를 8자 이상으로 설정하세요.",
 	"error.user.password.notSame": "\uc554\ud638\ub97c \ud655\uc778\ud558\uc138\uc694.",
 	"error.user.password.undefined": "암호가 설정되지 않았습니다.",
 	"error.user.password.wrong": "암호가 올바르지 않습니다.",
 	"error.user.role.invalid": "올바른 역할을 지정하세요.",
diff --git a/i18n/translations/lt.json b/i18n/translations/lt.json
index 3ec6b12c2..d1d2a54dd 100644
--- a/i18n/translations/lt.json
+++ b/i18n/translations/lt.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Neturite leidimo pašalinti vartotoją \"{name}\"",
 	"error.user.duplicate": "Vartotojas su el. paštu \"{email}\" jau yra",
 	"error.user.email.invalid": "Įrašykite teisingą el. pašto adresą",
 	"error.user.language.invalid": "Įrašykite teisingą kalbą",
 	"error.user.notFound": "Vartotojas \"{name}\" nerastas",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Prašome įrašyti galiojantį slaptažodį. Slaptažodį turi sudaryti bent 8 simboliai.",
 	"error.user.password.notSame": "Slaptažodžiai nesutampa",
 	"error.user.password.undefined": "Vartotojas neturi slaptažodžio",
 	"error.user.password.wrong": "Neteisingas slaptažodis",
 	"error.user.role.invalid": "Įrašykite teisingą rolę",
diff --git a/i18n/translations/nb.json b/i18n/translations/nb.json
index def3a1876..7acd8bdc3 100644
--- a/i18n/translations/nb.json
+++ b/i18n/translations/nb.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Du er ikke tillat \u00e5 slette denne brukeren",
 	"error.user.duplicate": "En bruker med e-postadresse \"{email}\" eksisterer allerede",
 	"error.user.email.invalid": "Vennligst skriv inn en gyldig e-postadresse",
 	"error.user.language.invalid": "Vennligst skriv inn et gyldig språk",
 	"error.user.notFound": "Brukeren kunne ikke bli funnet",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Vennligst skriv inn et gyldig passord. Passordet må minst være 8 tegn langt.",
 	"error.user.password.notSame": "Vennligst bekreft passordet",
 	"error.user.password.undefined": "Brukeren har ikke et passord",
 	"error.user.password.wrong": "Feil passord",
 	"error.user.role.invalid": "Vennligst skriv inn en gyldig rolle",
diff --git a/i18n/translations/nl.json b/i18n/translations/nl.json
index d4de462b1..2751f30ef 100644
--- a/i18n/translations/nl.json
+++ b/i18n/translations/nl.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Je hebt geen rechten om gebruiker \"{name}\" te verwijderen",
 	"error.user.duplicate": "Er bestaat al een gebruiker met e-mailadres \"{email}\"",
 	"error.user.email.invalid": "Gelieve een geldig emailadres in te voeren",
 	"error.user.language.invalid": "Gelieve een geldige taal in te voeren",
 	"error.user.notFound": "De gebruiker \"{name}\" kan niet worden gevonden",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Gelieve een geldig wachtwoord in te voeren. Wachtwoorden moeten minstens 8 karakters lang zijn.",
 	"error.user.password.notSame": "De wachtwoorden komen niet overeen",
 	"error.user.password.undefined": "De gebruiker heeft geen wachtwoord",
 	"error.user.password.wrong": "Fout wachtwoord",
 	"error.user.role.invalid": "Gelieve een geldige rol in te voeren",
diff --git a/i18n/translations/pl.json b/i18n/translations/pl.json
index 69ace65c8..3ad321a18 100644
--- a/i18n/translations/pl.json
+++ b/i18n/translations/pl.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Nie masz uprawnień, by usunąć użytkownika \"{name}\"",
 	"error.user.duplicate": "Istnieje już użytkownik z adresem email \"{email}\"",
 	"error.user.email.invalid": "Wprowadź poprawny adres email",
 	"error.user.language.invalid": "Proszę podać poprawny język",
 	"error.user.notFound": "Nie można znaleźć użytkownika \"{name}\"",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Wprowadź prawidłowe hasło. Hasła muszą mieć co najmniej 8 znaków.",
 	"error.user.password.notSame": "Hasła nie są takie same",
 	"error.user.password.undefined": "Użytkownik nie ma hasła",
 	"error.user.password.wrong": "Nieprawidłowe hasło",
 	"error.user.role.invalid": "Wprowadź poprawną rolę",
diff --git a/i18n/translations/pt_BR.json b/i18n/translations/pt_BR.json
index 750f41166..2ed241f8d 100644
--- a/i18n/translations/pt_BR.json
+++ b/i18n/translations/pt_BR.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Você não tem permissão para deletar o usuário \"{name}\"",
 	"error.user.duplicate": "Um usuário com o email \"{email}\" já existe",
 	"error.user.email.invalid": "Digite um endereço de email válido",
 	"error.user.language.invalid": "Digite um idioma válido",
 	"error.user.notFound": "Usuário \"{name}\" não encontrado",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Digite uma senha válida. Sua senha deve ter pelo menos 8 caracteres.",
 	"error.user.password.notSame": "As senhas não combinam",
 	"error.user.password.undefined": "O usuário não possui uma senha",
 	"error.user.password.wrong": "Senha errada",
 	"error.user.role.invalid": "Digite um papel válido",
diff --git a/i18n/translations/pt_PT.json b/i18n/translations/pt_PT.json
index 5382db0b6..cebba8430 100644
--- a/i18n/translations/pt_PT.json
+++ b/i18n/translations/pt_PT.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Não tem permissões para excluir o utilizador \"{name}\"",
 	"error.user.duplicate": "Um utilizador com o email \"{email}\" já existe",
 	"error.user.email.invalid": "Digite um endereço de email válido",
 	"error.user.language.invalid": "Digite um idioma válido",
 	"error.user.notFound": "Utilizador \"{name}\" não encontrado",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Digite uma palavra-passe válida. A sua palavra-passe deve ter pelo menos 8 caracteres.",
 	"error.user.password.notSame": "As palavras-passe não combinam",
 	"error.user.password.undefined": "O utilizador não possui uma palavra-passe",
 	"error.user.password.wrong": "Senha errada",
 	"error.user.role.invalid": "Digite uma função válida",
diff --git a/i18n/translations/ro.json b/i18n/translations/ro.json
index b8a5efdeb..9d6404dd1 100644
--- a/i18n/translations/ro.json
+++ b/i18n/translations/ro.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Nu ai voie să ștergi utilizatorul \"{name}\"",
 	"error.user.duplicate": "Există deja un utilizator cu adresa e-mail \"{email}\"",
 	"error.user.email.invalid": "Te rog introdu o adresă de e-mail validă",
 	"error.user.language.invalid": "Te rog introdu o limbă validă",
 	"error.user.notFound": "Utilizatorul \"{name}\" nu a fost găsit",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Te rog introdu o parolă validă. Parola trebuie să aibă cel puțin 8 caractere.",
 	"error.user.password.notSame": "Parolele nu se potrivesc",
 	"error.user.password.undefined": "Utilizatorul nu are parolă",
 	"error.user.password.wrong": "Parolă greșită",
 	"error.user.role.invalid": "Te rog introdu un rol valid",
diff --git a/i18n/translations/ru.json b/i18n/translations/ru.json
index df9ef2499..f0152c9cd 100644
--- a/i18n/translations/ru.json
+++ b/i18n/translations/ru.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "У вас нет права удалить пользователя \"{name}\"",
 	"error.user.duplicate": "Пользователь с Email \"{email}\" уже есть",
 	"error.user.email.invalid": "Пожалуйста, введите правильный адрес эл. почты",
 	"error.user.language.invalid": "Введите правильный язык",
 	"error.user.notFound": "Пользователь \"{name}\" не найден",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Пожалуйста, введите правильный пароль. Он должен состоять минимум из 8 символов.",
 	"error.user.password.notSame": "\u041f\u043e\u0436\u0430\u043b\u0443\u0439\u0441\u0442\u0430, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u0435 \u043f\u0430\u0440\u043e\u043b\u044c",
 	"error.user.password.undefined": "У пользователя нет пароля",
 	"error.user.password.wrong": "Неверный пароль",
 	"error.user.role.invalid": "Введите правильную роль",
diff --git a/i18n/translations/sk.json b/i18n/translations/sk.json
index bdd129a41..4f516c4d1 100644
--- a/i18n/translations/sk.json
+++ b/i18n/translations/sk.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Nemáte povolenie na zmazanie užívateľa \"{name}\"",
 	"error.user.duplicate": "Užívateľ s e-mailovou adresou \"{email}\" už existuje",
 	"error.user.email.invalid": "Prosím, zadajte platnú e-mailovú adresu",
 	"error.user.language.invalid": "Prosím, zadajte platný jazyk",
 	"error.user.notFound": "Užívateľa \"{name}\" nie je možné nájsť",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Prosím, zadajte platné heslo. Dĺžka hesla musí byť aspoň 8 znakov.",
 	"error.user.password.notSame": "Heslá nie sú rovnaké",
 	"error.user.password.undefined": "Užívateľ nemá heslo",
 	"error.user.password.wrong": "Wrong password",
 	"error.user.role.invalid": "Prosím, zadajte platnú rolu",
diff --git a/i18n/translations/sv_SE.json b/i18n/translations/sv_SE.json
index b8d66d505..66d68de86 100644
--- a/i18n/translations/sv_SE.json
+++ b/i18n/translations/sv_SE.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "Du har inte behörighet att radera användaren \"{name}\"",
 	"error.user.duplicate": "En användare med e-postadressen \"{email}\" finns redan",
 	"error.user.email.invalid": "Ange en giltig e-postadress",
 	"error.user.language.invalid": "Ange ett giltigt språk",
 	"error.user.notFound": "Användaren \"{name}\" kan ej hittas",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Ange ett giltigt lösenord. Lösenordet måste vara minst 8 tecken långt.",
 	"error.user.password.notSame": "Lösenorden matchar inte",
 	"error.user.password.undefined": "Användaren har inget lösenord",
 	"error.user.password.wrong": "Fel lösenord",
 	"error.user.role.invalid": "Ange en giltig roll",
diff --git a/i18n/translations/tr.json b/i18n/translations/tr.json
index ce12d2048..02b183f57 100644
--- a/i18n/translations/tr.json
+++ b/i18n/translations/tr.json
@@ -181,10 +181,11 @@
 	"error.user.delete.permission": "\"{name}\" kullanıcısını silme yetkiniz yok",
 	"error.user.duplicate": "\"{email}\" e-posta adresine sahip bir kullanıcı zaten var",
 	"error.user.email.invalid": "Lütfen geçerli bir e-posta adresi girin",
 	"error.user.language.invalid": "Lütfen geçerli bir dil girin",
 	"error.user.notFound": "\"{name}\" kullanıcısı bulunamadı",
+	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
 	"error.user.password.invalid": "Lütfen geçerli bir şifre giriniz. Şifreler en az 8 karakter uzunluğunda olmalıdır.",
 	"error.user.password.notSame": "L\u00fctfen \u015fifreyi do\u011frulay\u0131n",
 	"error.user.password.undefined": "Bu kullanıcının şifresi yok",
 	"error.user.password.wrong": "Yanlış şifre",
 	"error.user.role.invalid": "Lütfen geçerli bir rol girin",
diff --git a/src/Cms/User.php b/src/Cms/User.php
index 2154d9c1c..8a8fc968e 100644
--- a/src/Cms/User.php
+++ b/src/Cms/User.php
@@ -862,14 +862,21 @@ class User extends ModelWithContent
 	): bool {
 		if (empty($this->password()) === true) {
 			throw new NotFoundException(['key' => 'user.password.undefined']);
 		}
 
+		// `UserRules` enforces a minimum length of 8 characters,
+		// so everything below that is a typo
 		if (Str::length($password) < 8) {
 			throw new InvalidArgumentException(['key' => 'user.password.invalid']);
 		}
 
+		// too long passwords can cause DoS attacks
+		if (Str::length($password) > 1000) {
+			throw new InvalidArgumentException(['key' => 'user.password.excessive']);
+		}
+
 		if (password_verify($password, $this->password()) !== true) {
 			throw new InvalidArgumentException(['key' => 'user.password.wrong', 'httpCode' => 401]);
 		}
 
 		return true;
diff --git a/src/Cms/UserRules.php b/src/Cms/UserRules.php
index 3725f8c59..fc3e37065 100644
--- a/src/Cms/UserRules.php
+++ b/src/Cms/UserRules.php
@@ -339,16 +339,27 @@ class UserRules
 	public static function validPassword(
 		User $user,
 		#[SensitiveParameter]
 		string $password
 	): bool {
+		// too short passwords are ineffective
 		if (Str::length($password ?? null) < 8) {
 			throw new InvalidArgumentException([
 				'key' => 'user.password.invalid',
 			]);
 		}
 
+		// too long passwords can cause DoS attacks
+		// and are therefore blocked in the auth system
+		// (blocked here as well to avoid passwords
+		// that cannot be used to log in)
+		if (Str::length($password ?? null) > 1000) {
+			throw new InvalidArgumentException([
+				'key' => 'user.password.excessive',
+			]);
+		}
+
 		return true;
 	}
 
 	/**
 	 * Validates a user role
diff --git a/tests/Cms/Users/UserRulesTest.php b/tests/Cms/Users/UserRulesTest.php
index 17a3532d9..0b9c5e62b 100644
--- a/tests/Cms/Users/UserRulesTest.php
+++ b/tests/Cms/Users/UserRulesTest.php
@@ -55,10 +55,11 @@ class UserRulesTest extends TestCase
 	{
 		return [
 			['Email', 'domain.com', 'Please enter a valid email address'],
 			['Language', 'english', 'Please enter a valid language'],
 			['Password', '1234', 'Please enter a valid password. Passwords must be at least 8 characters long.'],
+			['Password', str_repeat('1234', 300), 'Please enter a valid password. Passwords must not be longer than 1000 characters.'],
 			['Role', 'rockstar', 'Please enter a valid role']
 		];
 	}
 
 	/**
diff --git a/tests/Cms/Users/UserTest.php b/tests/Cms/Users/UserTest.php
index 244c5cec5..b193d1541 100644
--- a/tests/Cms/Users/UserTest.php
+++ b/tests/Cms/Users/UserTest.php
@@ -197,10 +197,11 @@ class UserTest extends TestCase
 	{
 		return [
 			[null, false],
 			['', false],
 			['short', false],
+			[str_repeat('long', 300), false],
 			['invalid-password', false],
 			['correct-horse-battery-staple', true],
 		];
 	}
 
@@ -232,22 +233,38 @@ class UserTest extends TestCase
 		$caught = 0;
 
 		try {
 			$user->validatePassword('short');
 		} catch (\Kirby\Exception\InvalidArgumentException $e) {
+			$this->assertSame(
+				'Please enter a valid password. Passwords must be at least 8 characters long.',
+				$e->getMessage()
+			);
+			$this->assertSame(400, $e->getHttpCode());
+			$caught++;
+		}
+
+		try {
+			$user->validatePassword(str_repeat('long', 300));
+		} catch (\Kirby\Exception\InvalidArgumentException $e) {
+			$this->assertSame(
+				'Please enter a valid password. Passwords must not be longer than 1000 characters.',
+				$e->getMessage()
+			);
 			$this->assertSame(400, $e->getHttpCode());
 			$caught++;
 		}
 
 		try {
 			$user->validatePassword('longbutinvalid');
 		} catch (\Kirby\Exception\InvalidArgumentException $e) {
+			$this->assertSame('Wrong password', $e->getMessage());
 			$this->assertSame(401, $e->getHttpCode());
 			$caught++;
 		}
 
-		$this->assertSame(2, $caught);
+		$this->assertSame(3, $caught);
 	}
 
 	public function testValidateUndefinedPassword()
 	{
 		$user = new User([

Vulnerable code: 		$this->assertSame(2, $caught);
Fixed code: 	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
	"error.user.password.excessive": "Please enter a valid password. Passwords must not be longer than 1000 characters.",
		// `UserRules` enforces a minimum length of 8 characters,
		// so everything below that is a typo
		// too long passwords can cause DoS attacks
		if (Str::length($password) > 1000) {
			throw new InvalidArgumentException(['key' => 'user.password.excessive']);
		}

		// too short passwords are ineffective
		// too long passwords can cause DoS attacks
		// and are therefore blocked in the auth system
		// (blocked here as well to avoid passwords
		// that cannot be used to log in)
		if (Str::length($password ?? null) > 1000) {
			throw new InvalidArgumentException([
				'key' => 'user.password.excessive',
			]);
		}

			['Password', str_repeat('1234', 300), 'Please enter a valid password. Passwords must not be longer than 1000 characters.'],
			[str_repeat('long', 300), false],
			$this->assertSame(
				'Please enter a valid password. Passwords must be at least 8 characters long.',
				$e->getMessage()
			);
			$this->assertSame(400, $e->getHttpCode());
			$caught++;
		}

		try {
			$user->validatePassword(str_repeat('long', 300));
		} catch (\Kirby\Exception\InvalidArgumentException $e) {
			$this->assertSame(
				'Please enter a valid password. Passwords must not be longer than 1000 characters.',
				$e->getMessage()
			);
			$this->assertSame('Wrong password', $e->getMessage());
		$this->assertSame(3, $caught);