GitHub Advisoryadvisory · Packagist

GHSA-6423-85cc-8gf6 Joomla CMS Multi-Factor Authentication Bypass

HIGH Published 2025-04-08 Modified 2025-04-09 Official page ↗

Aliases: CVE-2025-25227
Ecosystem: Packagist
Packages: joomla/joomla-cms
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses: CWE-287
Reviewed: 2025-04-09

Affected packages

• Packagist joomla/joomla-cms: >= 5.0.0, < 5.2.6 → fixed in 5.2.6 • Packagist joomla/joomla-cms: >= 4.0.0, < 4.4.13 → fixed in 4.4.13

Description

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Related

Alias · CVE (1)

CVE-2025-25227 Insufficient state checks lead to a vector that allows to bypass 2FA checks. vulnerability

Weakness · CWE (1)

CWE-287 Improper Authentication weakness

References