CVE-2025-43799: Liferay DXP Auth Bypass Vulnerability

CVE-2025-43799 Overview

CVE-2025-43799 is a broken access control vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows users who have not yet changed their initial password to access and edit content through the platform's APIs. Liferay Portal versions 7.4.0 through 7.4.3.111 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 are affected, along with older unsupported versions. The issue is classified under [CWE-1393: Use of Default Password]. Remote attackers can leverage accounts created with default or initial passwords to interact with API endpoints that should require completed account setup.

Critical Impact
Attackers holding an initial password can bypass first-login controls and read or modify Liferay content through APIs, breaking confidentiality and integrity of hosted portal data.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.111 (and older unsupported versions)
Liferay DXP 7.4 GA through update 92, and 7.3 GA through update 35
Liferay DXP 2023.Q4.0 and 2023.Q3.1 through 2023.Q3.4

Discovery Timeline

2025-09-15 - CVE-2025-43799 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43799

Vulnerability Analysis

The vulnerability is a broken access control weakness in Liferay's API authorization flow. Liferay accounts that have not completed the mandatory initial password change should be restricted to the password reset workflow. The affected versions fail to enforce this restriction on API endpoints. As a result, any authenticated session backed by an initial password can call APIs that read or edit portal content. The impact is limited to confidentiality and integrity of content accessible to the compromised account, without availability effects.

Root Cause

Liferay's authentication pipeline correctly gates the web UI behind the "change password on first use" prompt but does not apply the same gate to headless and JSON API entry points. The API layer treats an authenticated principal as fully provisioned regardless of the passwordReset flag on the user record. This inconsistency between UI and API access controls is what [CWE-1393] describes as improper handling of default or initial credential state.

Attack Vector

An attacker who obtains or is issued an initial password, common in bulk provisioning, self-registration flows, or leaked onboarding emails, authenticates directly against the API. Instead of being forced through the password change form, the attacker calls headless REST or JSON-WS endpoints. From there, the attacker can enumerate or modify content objects that the target account is permitted to access. No user interaction, elevated privileges, or exploit code are required. See the Liferay Security Advisory CVE-2025-43799 for vendor technical details.

// No public proof-of-concept code has been released for CVE-2025-43799.
// Refer to the Liferay Security Advisory for authoritative technical details.

Detection Methods for CVE-2025-43799

Indicators of Compromise

API requests from user accounts whose passwordReset attribute is still true at the time of the call.
Content modification events (creation, update, deletion) originating from accounts that have never completed a first login through the web UI.
Unusual access to /o/headless-* or /api/jsonws/* endpoints from newly provisioned or dormant accounts.

Detection Strategies

Correlate authentication logs with user profile state to flag any API call authenticated by an account still flagged for password reset.
Baseline normal API consumers (integration users vs. human users) and alert when accounts that have never used the UI begin issuing API traffic.
Review Liferay audit logs for content edits attributed to users who have not completed initial onboarding.

Monitoring Recommendations

Forward Liferay application and access logs to a centralized logging or SIEM platform and retain them long enough to review post-patch.
Monitor for spikes in POST, PUT, PATCH, and DELETE calls to headless APIs against content services.
Track newly created accounts that authenticate to APIs before their first interactive login as a high-fidelity signal.

How to Mitigate CVE-2025-43799

Immediate Actions Required

Apply the Liferay-provided fixes for Portal and DXP referenced in the vendor advisory as soon as possible.
Force a password reset for any account that has never logged in and invalidate outstanding initial credentials.
Audit content changes performed by accounts flagged with passwordReset=true since the affected versions were deployed.

Patch Information

Liferay has published guidance and updates in the Liferay Security Advisory CVE-2025-43799. Upgrade Liferay DXP to a release beyond 7.4 update 92 or 7.3 update 35, and Liferay Portal to a fixed 7.4.3.x release as indicated by the advisory. Customers on unsupported branches should migrate to a supported release line.

Workarounds

Disable self-registration and bulk-provisioning workflows that rely on shared initial passwords until patching is complete.
Restrict access to /o/headless-* and /api/jsonws/* endpoints at the reverse proxy or web application firewall for accounts that have not completed onboarding.
Shorten the initial password validity window and require administrators to distribute one-time credentials with short expiry.

bash

# Example: block headless API access from non-onboarded accounts at the reverse proxy
# (Adapt to your NGINX, Apache, or WAF configuration)
location ~ ^/(o/headless-|api/jsonws/) {
    # Require a session cookie that is only set after first-login password change
    if ($cookie_LFR_ONBOARDED != "1") {
        return 403;
    }
    proxy_pass http://liferay_backend;
}