GHSA-hgr8-qvp5-mhch: GLPI: MFA bypass

Published Nov 4, 2026

Updated

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 11.0.8

Event History

Nov 4, 2026

CVE Published

via OSV·10:21 PM

Data Sourced

via OSV·10:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

GLPI deployments running versions from 11.0.0 through 11.0.8 are identified as affected. An attacker can exploit the issue remotely during login without prior authentication.

What does an attacker need to bypass MFA?

The attacker needs to submit a crafted URL during the login process. No credentials or user interaction are required according to the advisory.

Does this vulnerability affect MFA-protected accounts?

Yes. The flaw allows one-time-password verification to be skipped, defeating the two-factor authentication step during login.

What version fixes the issue?

The advisory states that the issue is fixed in GLPI version 11.0.8.

GHSA-hgr8-qvp5-mhch: GLPI: MFA bypass

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to bypass MFA?

Does this vulnerability affect MFA-protected accounts?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to bypass MFA?

Does this vulnerability affect MFA-protected accounts?

What version fixes the issue?