CVE-2025-47941: TYPO3 CMS Backend - Bypass of Multifactor Authentication
Summary
CVE-2025-47941: The TYPO3 CMS Backend has Broken Authentication in Backend MFA. Affects typo3/cms-backend across 2 version ranges.
>= 12.0.0, < 12.4.31
>= 13.0.0, < 13.4.12
Fixed in 12.4.31 or 13.4.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. It offers a robust backend interface for administrators and editors to manage content efficiently. The system supports various features, including user management, extensibility through plugins, and a flexible templating system. However, a recent vulnerability has been identified in the backend authentication process, specifically related to multifactor authentication (MFA), which could potentially allow unauthorized access to the backend.
Vulnerability Detail
The vulnerability arises from a flaw in the multifactor authentication (MFA) dialog during backend login, which can be bypassed due to insufficient enforcement of access restrictions on all backend routes. This means that even after successful authentication with valid backend user credentials, an attacker could exploit this weakness to gain unauthorized access to sensitive backend functionalities. The potential ramifications include unauthorized data access, manipulation of content, and overall compromise of the website's integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.4.3112.4.31composer require typo3/cms-backend:12.4.31 -
>= 13.0.0, < 13.4.1213.4.12composer require typo3/cms-backend:13.4.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
In summary, CVE-2025-47941 presents a significant security risk for TYPO3 CMS Backend users due to the potential bypass of multifactor authentication. It is crucial for users to update to the latest patched versions to mitigate this risk and protect their systems from unauthorized access.
See every vulnerability recorded for typo3/cms-backend →
FAQ
CVE-2025-47941 is a vulnerability in the TYPO3 CMS Backend that allows the bypassing of multifactor authentication during backend login.
You can check if your TYPO3 installation is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to assess your application without needing to sign up.
The vulnerability could lead to unauthorized access to the backend, allowing attackers to manipulate content and compromise the website's integrity.
You can update TYPO3 to the patched version using Composer with the command: composer require typo3/cms-backend:^12.4.31 or composer require typo3/cms-backend:^13.4.12.
The CVSS score for this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
