Liferay Portal exposes 500 status when attempting login with a deleted client secret

MEDIO 5.3CVE-2025-43777 · GHSA-9vwq-j6gq-w9xh · Published 09/09/2025 · updated 18/10/2026

In breve

CVE-2025-43777 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda com.liferay:com.liferay.portal.security.sso.openid.connect.impl, digital experience platform (liferay), liferay portal (liferay).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.24%, superiore al 14.8% delle vulnerabilità.
Correzione: aggiornare a 7.0.48, 2024.q1.20, 2025.Q1.17, 2025.Q2.10 o successiva.

Package	Affected versions	Patched versions
com.liferay:com.liferay.portal.security.sso.openid.connect.impl Maven	`≥ 6.0.4, < 7.0.48`	`7.0.48`
digital experience platform liferay	`≥ 2024.Q3.0, ≤ 2024.Q3.13≥ 2024.q1.1, < 2024.q1.20≥ 2024.q2.0, ≤ 2024.q2.13≥ 2024.q4.0, ≤ 2024.q4.7≥ 2025.Q1.0, < 2025.Q1.17≥ 2025.Q2.0, < 2025.Q2.10`	`2024.q1.202025.Q1.172025.Q2.10`
liferay portal liferay	`≥ 7.4.0, ≤ 7.4.3.132`	No fix yet

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-43777 · ADVISORY
liferay/liferay-portal commit e4ae0e4 · WEB
liferay/liferay-portal · PACKAGE
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43777 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In breve

CVE-2025-43777 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda com.liferay:com.liferay.portal.security.sso.openid.connect.impl, digital experience platform (liferay), liferay portal (liferay).

Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.24%, superiore al 14.8% delle vulnerabilità.

Correzione: aggiornare a 7.0.48, 2024.q1.20, 2025.Q1.17, 2025.Q2.10 o successiva.

Package

Affected versions

Patched versions

com.liferay:com.liferay.portal.security.sso.openid.connect.impl

Maven

≥ 6.0.4, < 7.0.48

7.0.48

digital experience platform

liferay

≥ 2024.Q3.0, ≤ 2024.Q3.13≥ 2024.q1.1, < 2024.q1.20≥ 2024.q2.0, ≤ 2024.q2.13≥ 2024.q4.0, ≤ 2024.q4.7≥ 2025.Q1.0, < 2025.Q1.17≥ 2025.Q2.0, < 2025.Q2.10

2024.q1.202025.Q1.172025.Q2.10

liferay portal

liferay

≥ 7.4.0, ≤ 7.4.3.132

No fix yet

Description

NVD description