CVE-2025-3639: Liferay Portal Login Bypass Vulnerability in com.liferay.portal:release.portal.bom
Summary
CVE-2025-3639: Liferay Portal Login Bypass Vulnerability. Affects com.liferay.portal:release.portal.bom versions >= 7.3.0-ga1, <= 7.4.3.132-ga132. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform designed for building web applications and managing content. It provides a robust framework for developing enterprise-level applications with features such as user management, content management, and collaboration tools. The vulnerability in question affects versions 7.3.0 through 7.4.3.132, allowing unauthenticated users with valid credentials to bypass the login process when Multi-Factor Authentication (MFA) is enabled.
Vulnerability Detail
The vulnerability arises from a flaw in the authentication process of Liferay Portal, where an attacker can exploit the system by changing the HTTP POST method to GET. This allows them to bypass the login mechanism, even with MFA enabled, potentially leading to unauthorized access to sensitive information and functionalities within the portal. The affected versions include Liferay DXP 2025.Q1 through 2025.Q1.6 and various updates of Liferay Portal, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the GET method for login requests or implement additional security measures to monitor and restrict access until the patch is applied.
Conclusion
CVE-2025-3639 represents a serious security vulnerability in Liferay Portal that allows unauthorized access through a bypass of the login process. It is crucial for users to update to the latest patched version to mitigate risks and ensure the security of their applications.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2025-3639 is a vulnerability in Liferay Portal that allows unauthenticated users with valid credentials to bypass the login process when MFA is enabled.
The affected versions include Liferay Portal 7.3.0 through 7.4.3.132 and Liferay DXP 2025.Q1 through 2025.Q1.6.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider implementing workarounds such as disabling the GET method for login requests or enhancing monitoring for unauthorized access.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data and functionalities, posing significant security risks to the organization.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
