Insufficient Session Expiration in Liferay Portal and Liferay DXP

CVE-2025-43819

What is CVE-2025-43819?

An Insufficient Session Expiration vulnerability exists in Liferay Portal and Liferay DXP, allowing remote non-authenticated attackers to hijack user sessions. This weakness permits the reuse of stale user sessions via the Single Logout (SLO) API, posing a significant risk to user data and privacy. Systems running the specified versions may be susceptible to unauthorized access if not properly patched.

References