Do not allow the password hash to be used for authentication.

(cherry picked from commit acbbef76)

lib/SimpleSAML/Utils/Crypto.php

@@ -429,6 +429,10 @@ class Crypto
             throw new \InvalidArgumentException('Invalid input parameters.');
         }
 
+        if (!is_null(password_get_info($password)['algo'])) {
+            throw new Error\Exception("Cannot use a hash value for authentication.");
+        }
+
         if (password_verify($password, $hash)) {
             return true;
         }

tests/lib/SimpleSAML/Utils/CryptoTest.php

@@ -237,6 +237,18 @@ PHP;
         $this->assertFalse($res);
     }
 
+    /**
+     * Check that hash cannot be used to authenticate ith.
+     */
+    public function testHashAsPwInvalid(): void
+    {
+        $pw = "password";
+
+        $hash = Crypto::pwHash($pw);
+        $this->expectException(Error\Exception::class);
+        $res = Crypto::pwValid($hash, $hash);
+    }
+
 
     /**
      * @covers \SimpleSAML\Utils\Crypto::pwValid