Unauthenticated brute-force enablement via noncanonical rate-limit keys

Improper rate limiting in Strapi before 4.12.1 allows remote attackers to bypass admin login throttling with path variants. The admin rateLimit middleware keys attempts with the literal email, request path, and IP address even though Koa routes case and trailing-slash variants to the same login handler. No credentials are required to rotate path capitalization or append a slash, reset the effective counter, and continue password guessing against administrator accounts.