From 0655a633546037107a1e0f3243c542fbaea0901f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Garc=C3=ADa=20Montoro?=
 <alejandro.garciamontoro@gmail.com>
Date: Tue, 27 Jan 2026 07:53:29 +0100
Subject: [PATCH] Check password length (#35062)

Automatic Merge
---
 server/channels/app/users/password.go      |  4 ++++
 server/channels/app/users/password_test.go | 21 +++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/server/channels/app/users/password.go b/server/channels/app/users/password.go
index 4282c7e650..c63b9c34a7 100644
--- a/server/channels/app/users/password.go
+++ b/server/channels/app/users/password.go
@@ -25,6 +25,10 @@ func ComparePassword(hash string, password string) error {
 		return errors.New("empty password or hash")
 	}
 
+	if len(password) > model.PasswordMaximumLength {
+		return NewErrInvalidPassword("model.user.is_valid.pwd_max_length.app_error")
+	}
+
 	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
 }
 
diff --git a/server/channels/app/users/password_test.go b/server/channels/app/users/password_test.go
index 971cc38173..f9fb887124 100644
--- a/server/channels/app/users/password_test.go
+++ b/server/channels/app/users/password_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
 
 	"github.com/mattermost/mattermost/server/public/model"
 )
@@ -131,3 +132,23 @@ func TestIsPasswordValidWithSettings(t *testing.T) {
 		})
 	}
 }
+
+func TestComparePassword(t *testing.T) {
+	password := "a password"
+	hashBytes, err := bcrypt.GenerateFromPassword([]byte(password), 10)
+	require.NoError(t, err)
+	hash := string(hashBytes)
+
+	t.Run("password length ok", func(t *testing.T) {
+		err := ComparePassword(hash, password)
+		assert.NoError(t, err)
+	})
+
+	t.Run("password too long", func(t *testing.T) {
+		err := ComparePassword(hash, strings.Repeat("a", model.PasswordMaximumLength+1))
+		assert.Error(t, err)
+		errInvalid, ok := err.(*ErrInvalidPassword)
+		assert.True(t, ok)
+		assert.Equal(t, "model.user.is_valid.pwd_max_length.app_error", errInvalid.Id())
+	})
+}