Oversized password login DoS in legacy password comparison (CVE-2026-24458)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/channels/api4/user.go:2060

   login

2. 1
   Step 01server/channels/api4/user.go:2060-2096

   The unauthenticated login endpoint parses the attacker-supplied JSON body, including password, and passes it into authentication.

   props := model.MapFromJSON(r.Body)
   loginId := props["login_id"]
   password := props["password"]
   mfaToken := props["token"]
   
   user, err = c.App.AuthenticateUserForLogin(c.AppContext, id, loginId, password, mfaToken, "", ldapOnly)
   

3. 2
   Step 02server/channels/app/authentication.go:65-78

   checkUserPassword obtains the hasher from the stored hash and compares the attacker-supplied plaintext password with it.

   hasher, phc, err := hashers.GetHasherFromPHCString(user.Password)
   if err != nil {
       return model.NewAppError("checkUserPassword", "api.user.check_user_password.invalid_hash.app_error", nil, "user_id="+user.Id, http.StatusUnauthorized)
   }
   
   err = hasher.CompareHashAndPassword(phc, password)
   

4. 3
   Step 03server/channels/app/password/hashers/bcrypt.go:75-85

   The 11.x fix adds a maximum-length check to the legacy bcrypt comparison wrapper before calling bcrypt.CompareHashAndPassword.

   func (b BCrypt) CompareHashAndPassword(hash phcparser.PHC, password string) error {
       if len(password) > PasswordMaxLengthBytes {
           return ErrPasswordTooLong
       }
   
       err := bcrypt.CompareHashAndPassword([]byte(hash.Hash), []byte(password))
       if errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
           return ErrMismatchedHashAndPassword
       }
   
       return err
   }
   

5. 4
   Step 04server/channels/app/users/password.go:23-31 (release-10.11 fix)

   The 10.11 fix adds the same fail-fast length check to the older ComparePassword helper before the bcrypt comparison call.

   func ComparePassword(hash string, password string) error {
       if password == "" || hash == "" {
           return errors.New("empty password or hash")
       }
   
       if len(password) > model.PasswordMaximumLength {
           return NewErrInvalidPassword("model.user.is_valid.pwd_max_length.app_error")
       }
   
       return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
   }
   

6. Sinkserver/channels/app/password/hashers/bcrypt.go:75

   BCrypt.CompareHashAndPassword