Authentication Bypass Vulnerability in Liferay Portal and Liferay DXP

CVE-2025-3639

What is CVE-2025-3639?

This vulnerability allows unauthenticated users who possess valid credentials to bypass the usual login process on Liferay Portal and Liferay DXP. By changing the HTTP POST method to GET while Multi-Factor Authentication (MFA) is enabled, attackers can gain unauthorized access. This flaw affects multiple versions of both Liferay Portal and Liferay DXP, highlighting critical security implications for organizations using these platforms.

References