CVE-2025-3639 Liferay Portal Login Bypass Vulnerability
Authenticated users can bypass Multi-Factor Authentication by changing the HTTP method from POST to GET during login.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-3639?
CVE-2025-3639 is a low-severity authentication bypass vulnerability in Liferay DXP, published on 18 Aug 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.
Weakness: CWE-288
Which versions are affected by CVE-2025-3639?
2 open source packages ship an affected version, including com.liferay.portal:release.portal.bom.
| Package | Affected | Fixed in |
|---|---|---|
com.liferay.portal:release.portal.bom Maven | From 7.3.0-ga1 to 7.4.3.132-ga132 | None |
com.liferay.portal:release.portal.bom Maven | From 7.3.0-ga1 to 7.4.3.132-ga132 | None |
How do I fix CVE-2025-3639?
No fix has been published for CVE-2025-3639 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-3639 being exploited?
There is no known exploitation of CVE-2025-3639 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-g4wg-mpfg-x2q6.