CVE-2025-43754: Liferay DXP Username Enumeration Flaw

CVE-2025-43754 Overview

CVE-2025-43754 is a username enumeration vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows unauthenticated attackers to determine whether a specific account exists on the platform by measuring the server processing time of login requests. This class of weakness is tracked under [CWE-208: Observable Timing Discrepancy]. The vulnerability requires no authentication, no user interaction, and can be exploited remotely over the network. While it does not directly permit code execution or data extraction, it provides attackers with confirmed account identifiers that streamline credential stuffing, password spraying, and phishing operations against Liferay-hosted portals.

Critical Impact
Remote, unauthenticated attackers can enumerate valid usernames on Liferay Portal and DXP instances via login response timing analysis, enabling targeted credential attacks against confirmed accounts.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay Portal 7.4 GA through update 92
Liferay DXP 2024.Q4.0–2024.Q4.7, 2024.Q3.0–2024.Q3.13, 2024.Q2.0–2024.Q2.13, and 2024.Q1.1–2024.Q1.14

Discovery Timeline

2025-08-21 - CVE-2025-43754 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43754

Vulnerability Analysis

The vulnerability is a timing-based side channel in the Liferay authentication flow. When a client submits credentials to the login endpoint, the server takes measurably different amounts of time to respond depending on whether the submitted username corresponds to a real account. Accounts that exist trigger additional backend work — typically a password hash comparison against the stored credential — while nonexistent accounts short-circuit the authentication logic and return sooner. By issuing large batches of login requests and recording response latency, an attacker can classify submitted usernames as valid or invalid without ever authenticating.

The issue affects both Liferay Portal 7.4 and the commercial Liferay DXP quarterly release trains, indicating the timing discrepancy resides in shared authentication code. Because Liferay is widely deployed as an intranet, extranet, and customer portal platform, valid usernames often correspond directly to corporate email addresses or employee identifiers that hold value in downstream attacks.

Root Cause

The root cause is unequal processing time between the code path executed for known users and the code path executed for unknown users. The authentication routine does not normalize execution time by performing a dummy password hash operation when the account is missing. This leaks account existence through an observable side channel [CWE-208].

Attack Vector

An attacker submits repeated POST requests to the Liferay login endpoint with candidate usernames and arbitrary passwords. The attacker records the round-trip latency of each response. Statistical analysis of the latency distribution — typically comparing medians across many samples per candidate — reveals which usernames trigger the slower authenticated code path. No credentials, session, or prior access is required. The attack scales trivially against username lists derived from OSINT, breach corpora, or corporate directory conventions.

No public proof-of-concept exploit or exploit database entry is currently associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-43754

Indicators of Compromise

High-volume POST requests to /c/portal/login or the Login action URL originating from a single source IP or small IP pool.
Login attempts iterating through sequential or dictionary-derived usernames with static or randomized passwords.
Anomalous distribution of failed login events with unusually uniform request intervals suggesting automation.

Detection Strategies

Aggregate Liferay access logs and alert on sources exceeding a threshold of failed login attempts per minute against distinct usernames.
Correlate web server response times for login requests to identify scripted timing measurement patterns.
Deploy WAF rules to fingerprint enumeration tooling (Burp Intruder, Hydra, ffuf) hitting the authentication endpoint.

Monitoring Recommendations

Forward Liferay application and access logs to a centralized SIEM for behavioral baselining of login traffic.
Track per-source-IP metrics on unique usernames attempted within short time windows.
Monitor for spikes in AUTH_FAILURE audit events tied to non-existent accounts versus existing accounts.

How to Mitigate CVE-2025-43754

Immediate Actions Required

Upgrade Liferay Portal to a fixed release beyond 7.4.3.132 / update 92, and upgrade DXP to the fixed quarterly release identified in the vendor advisory.
Enforce account lockout, CAPTCHA, or progressive delays on repeated failed login attempts to raise the cost of enumeration.
Place the Liferay login endpoint behind a WAF and apply rate limiting per source IP and per username.

Patch Information

Liferay has published fix details in the Liferay Security Advisory CVE-2025-43754. Administrators should apply the patched Portal update or move to a fixed DXP quarterly release. The fix normalizes authentication processing time so that response latency no longer discloses account existence.

Workarounds

Deploy WAF or reverse-proxy rules that add randomized artificial latency to all responses from the login endpoint to mask real processing time differences.
Restrict portal login access to trusted networks or VPN clients where operationally feasible until patching completes.
Enable multi-factor authentication (MFA) portal-wide to reduce the downstream value of enumerated usernames.

bash

# Example NGINX rate limit for the Liferay login endpoint
limit_req_zone $binary_remote_addr zone=liferay_login:10m rate=5r/m;

server {
    location /c/portal/login {
        limit_req zone=liferay_login burst=10 nodelay;
        proxy_pass http://liferay_backend;
    }
}