CVE-2025-25227
CVE-2025-25227 · [20250402] - Joomla Core - MFA Authentication Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
joomla! cms
- Versions
- 4.0.0-4.4.12: Affected
- 5.0.0-5.2.5: Affected
No fix published
joomla/joomla-cms Packagist
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.2.6
Update to 5.2.6
joomla/joomla-cms Packagist
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.4.13
Update to 4.4.13