CVE-2025-25227

CVE-2025-25227: [20250402] - Joomla Core - MFA Authentication Bypass

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-287 · Improper authentication
Published April 8, 2025
Last update April 21, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Key dates

02Disclosure timeline

April 8, 2025 CVE published
April 21, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-3655 OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification CVE-2024-11917 JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins CVE-2023-51482 WordPress Eazy Plugin Manager plugin <= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability CVE-2024-12264 PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation CVE-2026-4021 Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion