CVE-2026-49470

Deferred Deferred - Pending Action

TOTP Brute Force in GLPI Software

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-49470

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	to 11.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability affects GLPI, an IT asset management software. Between versions 11.0.0 and 11.0.8, the time-based one-time password (TOTP) verification endpoint lacks rate limiting for failed attempts. This allows attackers with a user's primary credentials to repeatedly submit TOTP values, enabling brute-force attacks to bypass multi-factor authentication and gain unauthorized account access.

Detection Guidance

To detect this vulnerability, monitor GLPI login attempts and failed TOTP submissions. Check for repeated authentication attempts from the same user account, especially targeting the MFA verification endpoint. Review logs for excessive failed attempts in a short timeframe, which may indicate brute-force attacks.

Impact Analysis

If you use GLPI versions 11.0.0 to 11.0.8, an attacker who knows your login credentials could repeatedly guess your TOTP code until they gain access to your account. This could lead to unauthorized control over your IT assets, data theft, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected GLPI versions may face compliance violations, potential fines, and reputational damage due to inadequate MFA protections.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or later to address the TOTP verification flaw. Ensure no users are running vulnerable versions.

Hi! I’m here to help you understand CVE-2026-49470. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70