CVE-2025-47941: TYPO3 CMS Auth Bypass Vulnerability

CVE-2025-47941 Overview

CVE-2025-47941 is an authentication bypass vulnerability in TYPO3, an open source PHP based web content management system. The flaw exists in the multifactor authentication (MFA) dialog presented during backend login. Insufficient enforcement of access restrictions on backend routes allows authenticated users to bypass the MFA challenge.

The vulnerability affects TYPO3 versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS. Exploitation requires valid backend user credentials, since MFA bypass occurs only after successful primary authentication. The weakness is classified as [CWE-288] Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Attackers with valid backend credentials can bypass MFA protection and access backend routes that should require the second authentication factor, undermining defense against credential theft.

Affected Products

TYPO3 12.x branch versions prior to 12.4.31 LTS
TYPO3 13.x branch versions prior to 13.4.2 LTS
TYPO3 backend login subsystem with MFA enabled

Discovery Timeline

2025-05-20 - CVE-2025-47941 published to NVD
2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-47941

Vulnerability Analysis

The vulnerability resides in how TYPO3 enforces the MFA challenge across backend routes. After a user authenticates with username and password, TYPO3 presents an MFA dialog as a second step. However, the access restriction enforcing this MFA step is not consistently applied to all backend routes.

An attacker who possesses valid backend credentials can authenticate, then directly request backend routes that omit the MFA enforcement check. This grants the attacker access equivalent to a fully MFA-validated session, defeating the second authentication factor entirely.

The issue is post-authentication, so attackers must already hold valid backend credentials through phishing, credential reuse, brute force, or insider access. The vulnerability removes MFA as a compensating control against credential compromise.

Root Cause

The root cause is incomplete authorization enforcement in the backend routing layer. The MFA gating logic checks the user's MFA completion state on some routes but not on others. This inconsistency creates an alternate access path that bypasses the intended security control, matching the [CWE-288] pattern.

Attack Vector

Exploitation occurs over the network against the TYPO3 backend login endpoint. The attacker authenticates with stolen or compromised backend credentials. Instead of completing the presented MFA challenge, the attacker navigates directly to backend URLs that lack proper MFA enforcement. The session token issued after primary authentication is accepted on these routes despite the unsatisfied second factor.

The vulnerability manifests in TYPO3 backend route registration and middleware. See the TYPO3 Security Advisory and the GitHub Security Advisory for technical details on the affected components.

Detection Methods for CVE-2025-47941

Indicators of Compromise

Backend user sessions that access administrative routes without a corresponding MFA completion event in authentication logs.
Successful logins immediately followed by access to backend modules without the typical MFA challenge timestamp.
Anomalous geographic or temporal patterns from accounts with MFA configured but no recent MFA verification.

Detection Strategies

Review TYPO3 system logs (sys_log) and web server access logs for backend route requests that bypass the /typo3/login MFA verification step.
Correlate authentication events with subsequent backend module access to identify sessions that skipped the MFA dialog.
Hunt for backend session tokens used on protected routes without a logged MFA success event.

Monitoring Recommendations

Forward TYPO3 backend logs to a centralized SIEM and alert on backend access without matching MFA verification entries.
Monitor for failed and successful logins from unusual source IPs targeting backend users with elevated privileges.
Track MFA enrollment status changes and unexpected disabling of MFA on administrator accounts.

How to Mitigate CVE-2025-47941

Immediate Actions Required

Upgrade TYPO3 12.x installations to version 12.4.31 LTS or later.
Upgrade TYPO3 13.x installations to version 13.4.2 LTS or later.
Rotate credentials for all backend users and force password resets, particularly for accounts with administrator roles.
Audit backend access logs from before the patch date for signs of MFA bypass activity.

Patch Information

TYPO3 GmbH released fixed versions 12.4.31 LTS and 13.4.2 LTS that enforce MFA verification consistently across all backend routes. The patches are described in TYPO3 Core Security Advisory TYPO3-CORE-SA-2025-015 and the corresponding GitHub Security Advisory GHSA-744g-7qm9-hjh9. Apply the upgrade through Composer or the TYPO3 installer.

Workarounds

Restrict backend access to trusted IP ranges using web server or firewall rules until patching is complete.
Disable inactive backend accounts and reduce the number of users with administrator privileges.
Require strong, unique passwords for backend users to limit the effectiveness of credential-based exploitation.

bash

# Configuration example - upgrade TYPO3 via Composer
composer require typo3/cms-core:^12.4.31 --update-with-dependencies
# or for 13.x
composer require typo3/cms-core:^13.4.2 --update-with-dependencies