GLPI MFA bypass lets unauthenticated users skip one-time-password verification (CVE-2026-52848)

What happened

GLPI is an open-source IT asset and service management package. This issue sits in the login flow. From version 11.0.0 up to but not including 11.0.8, an attacker who can reach the GLPI login page over the network could craft a URL that skips the one-time-password step after the initial credentials check. This means an account protected by two-factor authentication is effectively reduced to a single factor: someone who already has the account's password would not need the second factor.

The CVSS 4.0 score is 9.2 (critical), with high impact to confidentiality, integrity and availability of the GLPI instance. The vector indicates network attack, low attack complexity, no privileges and no user interaction, with attack requirements present. The weakness is CWE-288, authentication bypass using an alternate path or channel. The sources for this advisory do not report active exploitation or public disclosure.

Who is affected

GLPI versions 11.0.0 up to but not including 11.0.8 are affected. GLPI is commonly used for IT asset management, helpdesk and service desk functions, and may be deployed internally or exposed through a portal. The practical risk is highest where the login page is reachable from the internet or a large internal network, and where users may use weak, reused or phished passwords, because the flaw removes the protection the second factor would otherwise provide.

What to do now

1. Confirm whether your deployment is in the affected range: GLPI 11.0.0 up to but not including 11.0.8, and identify accounts that rely on MFA.
2. Restrict access to the GLPI web interface. If it does not need to be reachable from the internet, place it behind a VPN or restrict it to known management networks.
3. Treat the affected instance as if MFA is not enforced for accounts on it. Reset passwords for accounts that may have been exposed and review recent successful logins for unusual activity.
4. Monitor GLPI's public advisory and release notes for a maintenance release. No patch availability is currently recorded in this advisory's data.

Beyond the patch

This flaw matters because MFA is only as strong as the login path that enforces it. If GLPI is reachable beyond the local network, Virtual CISO Services can help identify exposed management interfaces and reduce that external attack surface. For teams that rely on open-source components such as GLPI across their estate, Supply Chain Defense & Third-Party Risk helps track the software you depend on and the patch cycles that set your exposure window.