Authentication bypass via bcrypt password truncation

Authentication bypass in Red Hat Quay 3.8.14 allows remote attackers to authenticate with a truncated account password. Database-backed login compares bcrypt password hashes that ignore input after the 72-byte boundary, causing a valid long password and its 72-byte prefix to match. Exploitation requires a valid username and the first 72 bytes of a password longer than 72 bytes; successful use grants access to that account.