CVE-2026-52848: GLPI: MFA bypass

Published Nov 4, 2026

Updated

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 11.0.8

Event History

Nov 4, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which GLPI deployments are affected?

GLPI versions from 11.0.0 through 11.0.8 are identified as affected. The issue is fixed in version 11.0.8.

What does an attacker need to exploit this issue?

An attacker does not need an existing authenticated session. Exploitation requires using a crafted URL during the login phase to bypass one-time-password verification.

What is the impact of successful exploitation?

Successful exploitation defeats the configured two-factor authentication check by skipping one-time-password verification during login.