Username Enumeration Vulnerability in Liferay Portal and DXP

CVE-2025-43754

What is CVE-2025-43754?

A username enumeration vulnerability exists in Liferay Portal and DXP versions, allowing attackers to discern whether specific usernames are registered. By analyzing the server response times associated with login requests, an attacker can infer the existence of accounts in the application. This flaw can be exploited to facilitate further attacks, such as targeted phishing or credential stuffing. Companies using affected versions are advised to implement mitigation strategies promptly to enhance their web application security.

References