MyBB

Hi,

File: inc/datahandlers/user.php
Lines: 166-177

@ function verify_password() {
global $mybb;

$user = &$this->data;

// Always check for the length of the password.
        if(my_strlen($user['password']) < $mybb->settings['minpasswordlength'])
{
            $this->set_error('invalid_password_length', array($mybb->settings['minpasswordlength'], $mybb->settings['maxpasswordlength']));
            return false;
        }@

This just check minimum password length (and not maximum password length). I think line 173 must be:

if(my_strlen($user['password']) < $mybb->settings['minpasswordlength'] || my_strlen($user['password']) > $mybb->settings['maxpasswordlength'])