~ / search / GHSA-744g-7qm9-hjh9

GHSA-744g-7qm9-hjh9

The TYPO3 CMS Backend has Broken Authentication in Backend MFA

Source: GitHub Advisory Database (reviewed) High CVE-2025-47941

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms-backend >= 12.0.0, < 12.4.31 12.4.31
Packagist typo3/cms-backend >= 13.0.0, < 13.4.12 13.4.12

Details

As written in the advisory (Markdown source, shown as plain text).

### Problem The multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. ### Solution Update to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described. ### Credits Thanks to Jens Jacobsen and Y. Kahveci for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it.

References

External links from the advisory. They lead to third-party sites.