N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43798

CVE-2025-43798: Liferay DXP Missing Critical Step in Authentication

Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43798

CVE-2025-43798:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web	maven	< 2.0.25	2.0.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a Time-Based One-Time Password (TOTP) to be used multiple times within its validity period. The analysis of the patch commit 1df25e46675afe7c3a2754bf8968bcb9677db950 reveals the root cause. The changes are in the TimeBasedOTPBrowserSetupMFAChecker.java file.

The primary vulnerable function is _verify. The original implementation only checked the mathematical validity of the TOTP using MFATimeBasedOTPUtil.verifyTimeBasedOTP but did not implement a mechanism to prevent the same valid token from being used again. An attacker who intercepts a TOTP could reuse it to authenticate as the user until it expires.

The patch rectifies this by first fetching the lastValidTOTP from the user's mfaTimeBasedOTPEntry and comparing it against the submitted timeBasedOtpValue. If they match, the verification fails, effectively making the TOTP single-use.

The verifyBrowserRequest function, which calls _verify, was also modified to persist the newly used TOTP by calling _mfaTimeBasedOTPEntryLocalService.updateLastTOTP upon successful verification. This ensures that the next authentication attempt will correctly identify the token as having been used. Both functions are key runtime indicators for this vulnerability, as they are directly involved in the vulnerable authentication process.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.