CVE-2025-69615
Published: 10 March 2026
Summary
CVE-2025-69615 is a critical-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Telekom Account Management Portal. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69615 is an incorrect access control vulnerability (CWE-307) stemming from missing rate-limiting on two-factor authentication (2FA) in the Deutsche Telekom AG Telekom Account Management Portal. This flaw allows unlimited brute-force retries on 2FA, enabling full multi-factor authentication (MFA) bypass without any user interaction. It affects versions of the portal prior to the update on 2025-10-24, with a fix applied on 2025-11-03. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.
Remote attackers require no privileges or user interaction to exploit this issue over the network with low complexity. By repeatedly attempting brute-force guesses against the 2FA mechanism without rate limits, adversaries can fully bypass MFA protections, gaining unauthorized access to affected user accounts in the Telekom Account Management Portal and potentially compromising sensitive account data.
Mitigation requires updating the Telekom Account Management Portal to the version incorporating the fix released on 2025-11-03. Additional details are available in Telekom's security acknowledgements at https://www.telekom.com/en/company/data-privacy-and-security/news/acknowledgements-358300#R and a technical gist at https://gist.github.com/ethicalrohitt/b3e6d071aac8530459e8b3a5720bb832. The CVE was published on 2026-03-10T18:18:01.740.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208508
Vulnerability details
Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing rate limits directly enable unlimited brute-force guessing of 2FA codes (T1110), resulting in MFA bypass and unauthorized account access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-7 directly mandates limits on consecutive unsuccessful logon attempts and account locking, preventing unlimited brute-force retries on the 2FA mechanism.
SI-2 requires timely identification, reporting, and patching of flaws like the missing 2FA rate-limiting, directly addressing the code vulnerability via software updates.
IA-5 ensures authenticator management with sufficient strength of mechanism for 2FA, mitigating brute-force risks through secure handling and refresh of multi-factor authenticators.