Fix KeyNotFoundException in CryptographyProvider.Verify

When a password hash is missing the 'iterations' parameter, Verify now
throws a descriptive FormatException instead of KeyNotFoundException.

- Extract GetIterationsParameter() helper method to avoid code duplication
- Provide distinct error messages for missing vs invalid parameters
- Add comprehensive unit tests for CryptographyProvider

3 files changed, 128 insertions, 2 deletions

diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index 0fd509f84..171509382 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -209,6 +209,7 @@
  - [Kirill Nikiforov](https://github.com/allmazz)
  - [bjorntp](https://github.com/bjorntp)
  - [martenumberto](https://github.com/martenumberto)
+ - [ZeusCraft10](https://github.com/ZeusCraft10)
 
 # Emby Contributors
 
diff --git a/Emby.Server.Implementations/Cryptography/CryptographyProvider.cs b/Emby.Server.Implementations/Cryptography/CryptographyProvider.cs
index 5380c45d8..0381c4d35 100644
--- a/Emby.Server.Implementations/Cryptography/CryptographyProvider.cs
+++ b/Emby.Server.Implementations/Cryptography/CryptographyProvider.cs
@@ -39,22 +39,24 @@ namespace Emby.Server.Implementations.Cryptography
         {
             if (string.Equals(hash.Id, "PBKDF2", StringComparison.Ordinal))
             {
+                var iterations = GetIterationsParameter(hash);
                 return hash.Hash.SequenceEqual(
                     Rfc2898DeriveBytes.Pbkdf2(
                         password,
                         hash.Salt,
-                        int.Parse(hash.Parameters["iterations"], CultureInfo.InvariantCulture),
+                        iterations,
                         HashAlgorithmName.SHA1,
                         32));
             }
 
             if (string.Equals(hash.Id, "PBKDF2-SHA512", StringComparison.Ordinal))
             {
+                var iterations = GetIterationsParameter(hash);
                 return hash.Hash.SequenceEqual(
                     Rfc2898DeriveBytes.Pbkdf2(
                         password,
                         hash.Salt,
-                        int.Parse(hash.Parameters["iterations"], CultureInfo.InvariantCulture),
+                        iterations,
                         HashAlgorithmName.SHA512,
                         DefaultOutputLength));
             }
@@ -62,6 +64,27 @@ namespace Emby.Server.Implementations.Cryptography
             throw new NotSupportedException($"Can't verify hash with id: {hash.Id}");
         }
 
+        /// <summary>
+        /// Extracts and validates the iterations parameter from a password hash.
+        /// </summary>
+        /// <param name="hash">The password hash containing parameters.</param>
+        /// <returns>The number of iterations.</returns>
+        /// <exception cref="FormatException">Thrown when iterations parameter is missing or invalid.</exception>
+        private static int GetIterationsParameter(PasswordHash hash)
+        {
+            if (!hash.Parameters.TryGetValue("iterations", out var iterationsStr))
+            {
+                throw new FormatException($"Password hash with id '{hash.Id}' is missing required 'iterations' parameter.");
+            }
+
+            if (!int.TryParse(iterationsStr, CultureInfo.InvariantCulture, out var iterations))
+            {
+                throw new FormatException($"Password hash with id '{hash.Id}' has invalid 'iterations' parameter: '{iterationsStr}'.");
+            }
+
+            return iterations;
+        }
+
         /// <inheritdoc />
         public byte[] GenerateSalt()
             => GenerateSalt(DefaultSaltLength);
diff --git a/tests/Jellyfin.Server.Implementations.Tests/Cryptography/CryptographyProviderTests.cs b/tests/Jellyfin.Server.Implementations.Tests/Cryptography/CryptographyProviderTests.cs
new file mode 100644
index 000000000..052bdf740
--- /dev/null
+++ b/tests/Jellyfin.Server.Implementations.Tests/Cryptography/CryptographyProviderTests.cs
@@ -0,0 +1,102 @@
+using System;
+using Emby.Server.Implementations.Cryptography;
+using MediaBrowser.Model.Cryptography;
+using Xunit;
+
+namespace Jellyfin.Server.Implementations.Tests.Cryptography;
+
+public class CryptographyProviderTests
+{
+    private readonly CryptographyProvider _sut = new();
+
+    [Fact]
+    public void CreatePasswordHash_WithPassword_ReturnsHashWithIterations()
+    {
+        var hash = _sut.CreatePasswordHash("testpassword");
+
+        Assert.Equal("PBKDF2-SHA512", hash.Id);
+        Assert.True(hash.Parameters.ContainsKey("iterations"));
+        Assert.NotEmpty(hash.Salt.ToArray());
+        Assert.NotEmpty(hash.Hash.ToArray());
+    }
+
+    [Fact]
+    public void Verify_WithValidPassword_ReturnsTrue()
+    {
+        const string password = "testpassword";
+        var hash = _sut.CreatePasswordHash(password);
+
+        Assert.True(_sut.Verify(hash, password));
+    }
+
+    [Fact]
+    public void Verify_WithWrongPassword_ReturnsFalse()
+    {
+        var hash = _sut.CreatePasswordHash("correctpassword");
+
+        Assert.False(_sut.Verify(hash, "wrongpassword"));
+    }
+
+    [Fact]
+    public void Verify_PBKDF2_MissingIterations_ThrowsFormatException()
+    {
+        var hash = PasswordHash.Parse("$PBKDF2$69F420$62FBA410AFCA5B4475F35137AB2E8596B127E4D927BA23F6CC05C067E897042D");
+
+        var exception = Assert.Throws<FormatException>(() => _sut.Verify(hash, "password"));
+        Assert.Contains("missing required 'iterations' parameter", exception.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Verify_PBKDF2SHA512_MissingIterations_ThrowsFormatException()
+    {
+        var hash = PasswordHash.Parse("$PBKDF2-SHA512$69F420$62FBA410AFCA5B4475F35137AB2E8596B127E4D927BA23F6CC05C067E897042D");
+
+        var exception = Assert.Throws<FormatException>(() => _sut.Verify(hash, "password"));
+        Assert.Contains("missing required 'iterations' parameter", exception.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Verify_PBKDF2_InvalidIterationsFormat_ThrowsFormatException()
+    {
+        var hash = PasswordHash.Parse("$PBKDF2$iterations=abc$69F420$62FBA410AFCA5B4475F35137AB2E8596B127E4D927BA23F6CC05C067E897042D");
+
+        var exception = Assert.Throws<FormatException>(() => _sut.Verify(hash, "password"));
+        Assert.Contains("invalid 'iterations' parameter", exception.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Verify_PBKDF2SHA512_InvalidIterationsFormat_ThrowsFormatException()
+    {
+        var hash = PasswordHash.Parse("$PBKDF2-SHA512$iterations=notanumber$69F420$62FBA410AFCA5B4475F35137AB2E8596B127E4D927BA23F6CC05C067E897042D");
+
+        var exception = Assert.Throws<FormatException>(() => _sut.Verify(hash, "password"));
+        Assert.Contains("invalid 'iterations' parameter", exception.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Verify_UnsupportedHashId_ThrowsNotSupportedException()
+    {
+        var hash = PasswordHash.Parse("$UNKNOWN$69F420$62FBA410AFCA5B4475F35137AB2E8596B127E4D927BA23F6CC05C067E897042D");
+
+        Assert.Throws<NotSupportedException>(() => _sut.Verify(hash, "password"));
+    }
+
+    [Fact]
+    public void GenerateSalt_ReturnsNonEmptyArray()
+    {
+        var salt = _sut.GenerateSalt();
+
+        Assert.NotEmpty(salt);
+    }
+
+    [Theory]
+    [InlineData(16)]
+    [InlineData(32)]
+    [InlineData(64)]
+    public void GenerateSalt_WithLength_ReturnsArrayOfSpecifiedLength(int length)
+    {
+        var salt = _sut.GenerateSalt(length);
+
+        Assert.Equal(length, salt.Length);
+    }
+}