{"action":"Upgrade com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web to 2.0.25 or later.","affected":[{"fixed":"2.0.25","introduced":"0"}],"component":"com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web","cve_ids":["CVE-2025-43798"],"ecosystem":"Maven","epss":0.00177,"exploited":false,"fixed_versions":["2.0.25"],"ghsa_id":"GHSA-4p5r-3jmm-652q","id":"tcs_01M5N8BKMTMHGMDGVK55K4WH7G","modified_at":"2025-09-16T00:27:18.608056Z","published_at":"2025-09-15T21:30:56Z","references":["https://osv.dev/vulnerability/GHSA-4p5r-3jmm-652q","https://nvd.nist.gov/vuln/detail/CVE-2025-43798","https://github.com/liferay/liferay-portal/commit/1df25e46675afe7c3a2754bf8968bcb9677db950","https://github.com/liferay/liferay-portal","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43798"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-4p5r-3jmm-652q","url":"https://osv.dev/vulnerability/GHSA-4p5r-3jmm-652q"},{"source":"nvd","source_id":"CVE-2025-43798","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43798"}],"summary":"Liferay DXP Missing Critical Step in Authentication"}