GHSA-4p5r-3jmm-652qLow

Liferay DXP Missing Critical Step in Authentication

Published
September 15, 2025
Last Modified
September 16, 2025

🔗 CVE IDs covered (1)

CVE-2025-43798 →

📋 Description

Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.

🎯 Affected products1

  • maven/com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web:< 2.0.25

🔗 References (4)