CVE-2025-43798 Overview
CVE-2025-43798 is an authentication weakness in Liferay Digital Experience Platform (DXP) that permits a time-based one-time password (TOTP) to be accepted multiple times within its validity window. The flaw affects Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35. An attacker who obtains a valid TOTP code, whether through shoulder-surfing, phishing, malware, or interception, can replay it to authenticate as the legitimate user. The issue is tracked as CWE-304: Missing Critical Step in Authentication.
Critical Impact
Captured TOTP codes can be replayed within the validity window, undermining multi-factor authentication guarantees on affected Liferay DXP deployments.
Affected Products
- Liferay DXP 2023.Q4.0 and 2023.Q3.1 through 2023.Q3.4
- Liferay DXP 7.4 GA through update 92
- Liferay DXP 7.3 GA through update 35
Discovery Timeline
- 2025-09-15 - CVE-2025-43798 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43798
Vulnerability Analysis
TOTP is a second-factor authentication mechanism defined in RFC 6238 that derives a short-lived code from a shared secret and the current time interval, typically 30 seconds. A correct implementation must invalidate a code as soon as it is successfully used, so replaying it within the same window fails. Liferay DXP does not enforce this single-use property. The server validates that the submitted code matches the expected value for the current time step but does not record consumption of that code. An attacker who observes a code during its validity window can present the same value to the authentication endpoint and be granted a session.
Root Cause
The root cause is a missing critical step in the authentication workflow [CWE-304]. The TOTP verifier lacks server-side state tracking that marks a code as consumed after successful validation. Without this tracking, the check reduces to a stateless comparison against the algorithmically expected value for the current interval.
Attack Vector
Exploitation requires the attacker to obtain a currently valid TOTP code for a target account and to submit credentials plus that code before the interval expires. Realistic capture paths include phishing pages that relay codes, information-stealer malware that reads authenticator apps or SMS, and network-adjacent interception. The primary factor (password) is still required, so the vulnerability degrades rather than fully bypasses multi-factor authentication. No verified public exploit is available at the time of writing.
Detection Methods for CVE-2025-43798
Indicators of Compromise
- Successful authentications for the same user from different source IP addresses or user-agents within a single 30-second TOTP window.
- Repeated authentication events referencing the same TOTP submission value in application logs.
- Session creation events shortly after a user-reported phishing interaction targeting Liferay login pages.
Detection Strategies
- Correlate Liferay authentication logs with proxy and identity provider telemetry to flag concurrent or duplicated MFA challenges resolved with identical codes.
- Alert on impossible-travel scenarios or user-agent mismatches occurring within the same TOTP interval.
- Baseline normal MFA cadence per user and detect deviations such as multiple successful TOTP_VERIFY events within seconds.
Monitoring Recommendations
- Forward Liferay portal and authentication logs to a centralized analytics platform for retention and correlation.
- Monitor administrative account activity closely, as replay of an administrator's TOTP is the highest-impact scenario.
- Track login anomalies against threat intelligence indicators associated with credential phishing kits targeting Liferay.
How to Mitigate CVE-2025-43798
Immediate Actions Required
- Apply the fixed Liferay DXP versions identified in the Liferay Security Advisory for CVE-2025-43798.
- Inventory Liferay DXP instances, including 7.3, 7.4, and 2023.Q3/Q4 deployments, and prioritize internet-facing portals.
- Rotate TOTP secrets for privileged accounts after patching to invalidate any secrets that may have been captured.
Patch Information
Refer to the Liferay Security Advisory for CVE-2025-43798 for the definitive list of fixed builds. Customers on 7.3 and 7.4 should upgrade beyond update 35 and update 92 respectively, and Quarterly Release customers should move to a version later than 2023.Q4.0 that includes the fix.
Workarounds
- Where patching is not immediately possible, consider switching high-privilege accounts to hardware security keys (WebAuthn/FIDO2), which are not vulnerable to code replay.
- Restrict administrative access to Liferay DXP behind a VPN or identity-aware proxy that enforces its own single-use MFA.
- Shorten session lifetimes and require re-authentication for sensitive operations to limit the value of a replayed login.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
