CVE-2025-43798

Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.

Scoring

Severity

LOW

CVSS base score

2.1

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.18%

CWE

CWE-304

Published

2025-09-15

Last modified

2026-03-13

Affected products

• Liferay DXP
• Liferay DXP
• Liferay DXP
• Liferay DXP

Weakness type

• CWE-304

Related vulnerabilities

• CVE-2023-54391 — Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
• CVE-2026-59564 — Authentication bypass between ZCC and client connector portal
• CVE-2026-76207 — phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
• CVE-2026-49467 — TOTP enrollment hijack: password gate skipped due to unawaited promise
• CVE-2026-61466 — Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
• CVE-2026-67351 — Serendipity < 2.6.1 Authentication Bypass via Username Collision
• CVE-2026-55957 — Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
• CVE-2026-57915 — Apache Kerby: Kerberos Pre-Authentication Bypass

Markdown version · Browse all CVEs