Liferay Portal 7.3-7.4 MFA Login Bypass via GET (CVE-2025-3639)
CVE-2025-3639 Published on August 18, 2025
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.
Weakness Type
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
Products Associated with CVE-2025-3639
Want to know whenever a new CVE is published for Liferay Portal? stack.watch will email you.
Affected Versions
Liferay Portal:- Version 7.3.0, <= 7.4.3.132 is affected.
- Version 7.3.10, <= 7.3.10-u36 is affected.
- Version 7.4.13, <= 7.4.13-u92 is affected.
- Version 2024.Q1.1, <= 2024.Q1.15 is affected.
- Version 2024Q2.0, <= 2023.Q2.13 is affected.
- Version 2024.Q3.1, <= 2024.Q3.13 is affected.
- Version 2024.Q4.0, <= 2024.Q4.7 is affected.
- Version 2025.Q1.0, <= 2025.Q1.6 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.