Laravel 9 is rejecting a valid password hashed with bcrypt

I’ve been spending a few days troubleshooting a failure of certain passwords to validate in Laravel 9. The password testperson resolves to the hash $2y$10$5xc/wAmNCKV.YhpWOfyNoetCj/r3Fs5TyAskgZuIF/LEItWfm7rPW. A direct query on the corresponding database table confirms that this is the correct hash. Yet Laravel’s authentication infrastructure rejects this password and denies authentication.

This is not universal. I have multiple passwords that are resolving correctly. For example, the password eo resolves to $2y$10$uNWYvMVmagIwQ2eXnVKLCOAK1QFQdcRtxbvlghf.Xpg0U1w.N./N2, and Laravel authenticates that password. The same mechanism creates both of these user records, though they have different permissions (indicated by boolean values on the record).

I tracked down the bug to the function password_verify, which was identified as returning false negatives in this Stack Overflow question and this Treehouse thread.

Specifically, here is the stack in Laravel that gets down to this failure point:

• The login route calls IlluminateFoundationAuthAuthenticatesUsers::login via the controller class.
• The login method calls IlluminateFoundationAuthAuthenticatesUsers::attemptLogin.
• The attemptLogin method calls the attempt method of the controller’s guard object.
• IlluminateAuthSessionGuard::attempt calls IlluminateAuthSessionGuard::hasValidCredentials.
• IlluminateAuthSessionGuard::hasValidCredentials calls the validateCredentials method on the guard’s provider object.
• IlluminateAuthEloquentUserProvider::validateCredentials calls the check method on its hasher object.
• IlluminateHashingHashManager::check calls the check method on its driver.
• IlluminateHashingBcryptHasher::check calls IlluminateHashingAbstractHasher::check.
• IlluminateHashingAbstractHasher::check calls password_verify.

After unwinding this entire stack, I ran the following code in the login method of the login controller:

$provider = $this->guard()->getProvider();
$credentials =  $this->credentials($request);
$user = $provider->retrieveByCredentials($credentials);
$password_unhashed = $request['password'];
$password_hashed = $user->getAuthPassword();
$password_verify = password_verify($password_unhashed, $password_hashed);
logger('attemping login', compact('password_verify','password_unhashed','password_hashed'));

That dumps this context:

{
"password_verify": false,
"password_unhashed": "testperson",
"password_hashed": "$2y$10$5xc/wAmNCKV.YhpWOfyNoetCj/r3Fs5TyAskgZuIF/LEItWfm7rPW"
}

And if I put that password into a SELECT users WHERE password= query, I get the user that I’m expecting.

What’s going on here? And how do I get around this?