GHSA-g4wg-mpfg-x2q6 CVE-2025-3639

Liferay Portal Login Bypass Vulnerability

Low Maven

Severity: 0.0 / 10; Low · CVSS 4.0
Exploit chance (EPSS): 0.50%; Chance of exploitation in the next 30 days. Higher than 43.02% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Fix: None yet; No fixed version published

Description

Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

Affected versions

Maven

Package	Vulnerable	Fixed in
com.liferay.portal:release.portal.bom	`>= 7.3.0-ga1, <= 7.4.3.132-ga132`	No fix yet

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: High
User interaction: Passive
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): Low
Availability (vulnerable system): Low
Confidentiality (subsequent systems): Low
Integrity (subsequent systems): Low
Availability (subsequent systems): Low
Exploit maturity: Not defined
Scope: X

Weakness

CWE-288: Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it

Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2025-3639

Packages

github.com/liferay/liferay-portal

Timeline

Aug 18, 2025 Published
Jun 17, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-2j97-4jmq-c4xf Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter	Medium	Also affects com.liferay.portal:release.portal.bom
GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget	Medium	Also affects com.liferay.portal:release.portal.bom
GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks	Medium	Also affects com.liferay.portal:release.portal.bom
GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration	Medium	Also affects com.liferay.portal:release.portal.bom
GHSA-gv7w-jh8g-vr73 Liferay Portal Does Not Limit Access to APIs Before Email Verification	Medium	Also affects com.liferay.portal:release.portal.bom
GHSA-gh4w-8qgq-8w9r Liferay Portal Vulnerable to CSRF in Headless APIs	Medium	Also affects com.liferay.portal:release.portal.bom
GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text	Medium	Also affects com.liferay.portal:release.portal.bom
GHSA-vgqx-447m-wvcj Liferay Portal Vulnerable to DoS via Crafted Headless API Request	High	Also affects com.liferay.portal:release.portal.bom

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor