PT-2025-5587 · Typo3 · Typo3

Published 2025-01-28 · Updated 2025-03-16 · CVE-2025-24856

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 extension versions prior to 4.0.0

Description A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can be exploited if an attacker can anticipate the email address of the user, register a public frontend user account using that email address before the user's first OIDC login, and the IDP returns the field email containing the email address of the user.

Recommendations For versions prior to 4.0.0, update the extension to version 4.0.0 as soon as possible.

Exploit

Fix

IDOR

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-348

CWE-639

CWE-288

Related Identifiers

CVE-2025-24856

GHSA-HJ78-P4H7-M5FV

Affected Products

Typo3

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/causal/oidc/CVE-2025-24856.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-hj78-p4h7-m5fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24856 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24856 · Vendor Advisory
• https://github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3 · Note
• https://t.me/cvedetector/20394 · Telegram Post
• https://t.me/cvenotify/114944 · Telegram Post
• https://typo3.org/security/advisory/typo3-ext-sa-2025-001 · Note
• https://t.me/cvetracker/19216 · Telegram Post
• https://twitter.com/CVEnew/status/1901125608085786857 · Twitter Post