TYPO3 CMS uses insufficient entropy when generating passwords

MEDIUM 6.5CVE-2025-59015 · GHSA-p5jq-5383-qvc7 · Published 09/09/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
typo3/cms-core Packagist	`≥ 12.0.0, < 12.4.37≥ 13.0.0, < 13.4.18`	`12.4.3713.4.18`
typo3 typo3	`≥ 12.0.0, < 12.4.37≥ 13.0.0, < 13.4.18`	`12.4.3713.4.18`

Description

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-59015 · ADVISORY
TYPO3-CMS/core commit d2057cc · WEB
TYPO3-CMS/core · PACKAGE
typo3.org/security/advisory/typo3-core-sa-2025-019 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free