CVE-2025-47941 json
TYPO3 Has Broken Authentication in Backend MFA
published 2025-05-20 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-15829 , GHSA-744g-7qm9-hjh9
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. Users should update to TYPO3 version 12.4.31 LTS or 13.4.12 LTS to fix the problem.
Patch / fix
- packagist typo3/cms-backend 12.4.31, 13.4.12
- typo3 typo3 12.4.31, 13.4.12
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 17 mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-backend | >=12.0.0, <12.4.31 >=13.0.0, <13.4.12 |
12.4.31 13.4.12 |
Affected products
- TYPO3 typo3
Classification
- Weakness
-
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
References
-
github.com
/TYPO3-CMS/backend/commit/034f589029952084771c5f98d42ed0f69f9a7ead
web
-
github.com
/TYPO3/typo3/security/advisories/GHSA-744g-7qm9-hjh9
web, vendor-advisory
-
typo3.org
/security/advisory/typo3-core-sa-2025-015
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-47941
advisory
-
github.com
/TYPO3-CMS/backend
package
Sources
- CVE List CVE-2025-47941
- GitHub Advisory GHSA-744g-7qm9-hjh9
- NVD CVE-2025-47941
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.