{"affected":[],"cveId":"CVE-2025-54391","cwes":["CWE-284"],"description":"A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-Factor Authentication (2FA) protection. The attacker can configure an additional 2FA method (either a third-party authenticator app or email-based 2FA) without presenting a valid authentication token or proving access to an already configured 2FA method. This bypasses 2FA and results in unauthorized access to accounts that are otherwise protected by 2FA.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794075000200,"publishedAt":1758057333880,"references":[{"source":"cve@mitre.org","tags":[],"url":"https://wiki.zimbra.com/wiki/Security_Center"},{"source":"cve@mitre.org","tags":[],"url":"https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"},{"source":"cve@mitre.org","tags":[],"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"}],"remediation":[],"revision":"4cce9bd2d69148af0c5841cc530b48c2c70e2fd38595ce472979ae0b30fd0243","sources":[{"modifiedAt":1794075000200,"name":"NVD","retrievedAt":1794075431566,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54391"}],"ssvc":{"assessedAt":1758117383741,"automatable":"yes","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"total"},"status":"published","title":"CVE-2025-54391","updatedAt":1794075431566}