CVE-2025-69615 - Vulnerability Analysis

Overview

Deutsche Telekom AG Telekom Account Management Portal < 2025-10-24 contains a broken access control caused by missing 2FA rate-limiting, letting attackers perform unlimited brute-force retries and fully bypass MFA without user interaction.

Severity & Score

Impact

Attackers can bypass multi-factor authentication, gaining unauthorized access to user accounts.

Mitigation

Update to version 2025-11-03 or later.

References

• https://gist.github.com/ethicalrohitt/b3e6d071aac8530459e8b3a5720bb832
• https://www.telekom.com/en/company/data-privacy-and-security/news/acknowledgements-358300#R

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner