CVE-2025-23046: GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23046?
CVE-2025-23046 has a high severity due to its potential for unauthorized access to GLPI installations.
How do I fix CVE-2025-23046?
To fix CVE-2025-23046, upgrade GLPI to a version newer than 10.0.18.
What software versions are affected by CVE-2025-23046?
CVE-2025-23046 affects GLPI versions from 9.5.0 up to but not including 10.0.18.
What type of vulnerability is CVE-2025-23046?
CVE-2025-23046 is an authentication vulnerability related to OAuth connection in GLPI.
Can CVE-2025-23046 be exploited remotely?
Yes, CVE-2025-23046 can be exploited remotely by anyone with a valid username.