CVE-2026-52848

Deferred Deferred - Pending Action

Authentication Bypass in GLPI via URL Manipulation

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-52848

Affected Vendors & Products

Vendor	Product	Version / Range
glpi-project	glpi	>= 11.0.0, < 11.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI versions 11.0.0 to 11.0.8 allows an unauthenticated user to bypass two-factor authentication during login by exploiting a crafted URL. This defeats the one-time-password verification mechanism.

Impact Analysis

An attacker could gain unauthorized access to user accounts without needing the second authentication factor. This could lead to data breaches, unauthorized system access, or further exploitation of the IT management system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected GLPI versions may fail compliance audits due to inadequate access controls.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or later to address the vulnerability. Ensure no unauthenticated users can access login pages during the upgrade process.

Hi! I’m here to help you understand CVE-2026-52848. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...