External risk intelligence

Zimbra Collaboration 2FA Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-54391

Zimbra Collaboration is a web-based email and collaboration platform typically deployed as a public-facing service accessible over the internet to allow users to access their email and calendar remotely. The vulnerable SOAP endpoint is part of the standard authentication and account management flow, making it directly reachable in common internet-facing deployments of the product.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Zimbra Collaboration, a widely used email and collaboration platform. This issue allows authenticated attackers to bypass Two-Factor Authentication (2FA) for user accounts, potentially leading to unauthorized access. The vulnerability affects the process of configuring additional 2FA methods, enabling an attacker to circumvent existing security measures without proper validation.

Bypasses account security by tricking 2FA setup.
Protects accounts that rely on two-factor authentication.
Confirm if Zimbra is used and assess account exposure.

Attack Path

How an attacker could exploit the issue

An attacker with existing user credentials can bypass Two-Factor Authentication (2FA) by interacting with the EnableTwoFactorAuthRequest SOAP endpoint. This allows them to add a new 2FA method without proving access to their account or an existing 2FA token, ultimately gaining unauthorized access to the account.

Requires valid user credentials.
Triggers by configuring a new 2FA method.
Risk of unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker with valid user credentials could bypass Two-Factor Authentication (2FA) by configuring an additional 2FA method, leading to unauthorized account access.

Account access and user data.
Bypassing 2FA during configuration.
Unauthorized access to protected accounts.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical vulnerability in Zimbra Collaboration's 2FA bypass requires immediate attention from teams managing the application and its infrastructure. The first step is to identify all instances of Zimbra Collaboration, confirm their exposure, and determine business criticality to prioritize remediation efforts. This may involve coordination between application owners, platform teams, and security operations to understand the full scope and plan a controlled response.

Identify Zimbra instance owners and scope.
Verify external reachability and business impact.
Plan remediation with Zimbra vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zimbra Collaboration used for?

Zimbra Collaboration is an enterprise-grade software platform that provides email, calendaring, and document collaboration services. It is typically deployed as a server-side application that allows organizations to host their own private or shared messaging infrastructure, which users access through web browsers or email clients.

How does CVE-2025-54391 bypass 2FA?

This vulnerability falls under the Improper Access Control (CWE-284) weakness class. It occurs in the software's SOAP interface, where a logic flaw allows an authenticated user to register a new second-factor method—such as an email or authenticator app—without needing to provide an existing valid 2FA token to authorize the change.

Does this vulnerability trigger automatically?

No. The flaw is not triggered by simply visiting the site or by unauthenticated traffic. An attacker must first possess valid user credentials and then actively interact with the specific EnableTwoFactorAuthRequest endpoint to perform the unauthorized configuration change.

Is my Zimbra instance at risk?

According to Halo Surface Signal, Zimbra Collaboration is frequently deployed as a public-facing service to facilitate remote access, which makes this endpoint reachable over the internet. If your installation is accessible from external networks, the potential for exploitation increases as it broadens the reach for any attacker who manages to obtain valid credentials.

How should I respond to this advisory?

Begin by auditing your infrastructure to locate all instances of Zimbra Collaboration within your network. Once identified, evaluate the public accessibility of these servers and collaborate with your technical team to prioritize these assets based on their business importance while monitoring official vendor channels for specific security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.