Authentication bypass via BCrypt password truncation

Authentication bypass in Spring Security 6.4.3 and earlier allows remote attackers to access accounts via crafted long passwords. BCryptPasswordEncoder.matches(CharSequence,String) passes supplied UTF-8 password bytes to BCrypt without rejecting input over 72 bytes, so BCrypt ignores the suffix and compares only the first 72 bytes. The target account must use a password over 72 bytes, and remote attackers must know its first 72 bytes to authenticate as that account.