Two-Factor Authentication Bypass in Zimbra Collaboration by Zimbra

CVE-2025-54391

What is CVE-2025-54391?

A significant vulnerability exists within the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration that allows a malicious actor with valid user credentials to circumvent Two-Factor Authentication (2FA). By misconfiguring an additional 2FA method—either via a third-party authenticator app or through email-based 2FA—the attacker can gain unauthorized access to user accounts without presenting a valid authentication token or authenticating through an already established 2FA method. This flaw poses a serious risk to the security of user accounts protected by 2FA, enabling potential unauthorized access and exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References