Reduced Password Entropy

typo3/cms-core is vulnerable to reduced password entropy. The vulnerability is due to a deterministic three-character prefix in the Password Generation component, which reduces randomness and allows an attacker to perform brute-force attacks more efficiently...

CVE-2025-59015

TYPO3 CMS password generation vulnerability (CVE-2025-59015) affects TYPO3 CMS 12.0.0–12.4.36 and 13.0.0–13.4.17. A deterministic three-character prefix in the Password Generation component reduces entropy, enabling faster brute-force attacks. Impact is insufficient entropy in password generation...

CVE-2025-59015 Insufficient Entropy in Password Generation

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...