Replayable TOTP Auth in Liferay DXP 7.4 GA <92, 7.3 GA <35
CVE-2025-43798 Published on September 15, 2025
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a users TOTP to authenticate as the user.
Weakness Type
Missing Critical Step in Authentication
The software implements an authentication technique, but it skips a step that weakens the technique. Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.
Products Associated with CVE-2025-43798
Want to know whenever a new CVE is published for Liferay Digital Experience Platform? stack.watch will email you.
Affected Versions
Liferay DXP:- Version 7.3.10, <= 7.3.10-u35 is affected.
- Version 7.4.13, <= 7.4.13-u92 is affected.
- Version 2023.Q3.1, <= 2023.Q3.4 is affected.
- Version 2023.Q4.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.