dev.to/tag/security· Oct 28, 2026· by Serguey Asael Shinder

Your Password Check Stopped Reading After Seventy Two Bytes

The login service was slow, When a user signs in successfully, Next time, You needed a key It looked careful. It passed every test. Months later, It let him in. Here is the mechanism. bcrypt only reads Not characters. Bytes. Everything after that Your input started with the user ID, Put a long enough name in front, The hash is the same The cache says yes. This is not a thought experiment. In 2024 a large identity provider The cache key was bcrypt The same limit bites A passphrase of eighty chara

🎯 Vulnerability: Web Security Vulnerability

💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.

#sergueyasaelshinder#security#authentication#webdev

Your Password Check Stopped Reading After Seventy Two Bytes

More Writeups Like This

Your Query Used Parameters Everywhere Except the Sort Column

The JWT Validation Algorithm in RFC 7519 Never Checks Expiry. Seven Checks Your Code Has To Add

Pentesting Authentication: Timing Attacks and Token Manipulation

Your AI Agent Will Build an Insecure Login, Unless You Tell It Not To