GitHub Advisoryadvisory · Packagist

GHSA-744g-7qm9-hjh9 The TYPO3 CMS Backend has Broken Authentication in Backend MFA

HIGH Published 2025-05-20 Modified 2025-05-20 Official page ↗
Aliases
CVE-2025-47941
Ecosystem
Packagist
Packages
typo3/cms-backend
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-288
Reviewed
2025-05-20

Affected packages

• Packagist typo3/cms-backend: >= 12.0.0, < 12.4.31 → fixed in 12.4.31 • Packagist typo3/cms-backend: >= 13.0.0, < 13.4.12 → fixed in 13.4.12

Description

Problem The multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. Solution Update to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described. Credits Thanks to Jens Jacobsen and Y. Kahveci for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it.

Related

Alias · CVE (1)

  • CVE-2025-47941 TYPO3 is an open source, PHP based web content management system. vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References