{"id":"CVE-2026-52848","kind":"vulnerability","aliases":["CVE-2026-52848"],"related":[],"title":"GLPI: crafted login URL skips two-factor authentication check","description":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.","summary":"GLPI, a free asset and IT management application, lets an unauthenticated user use a crafted URL during login to skip the one-time-password check. An attacker who knows a valid password can therefore get into accounts without the second factor.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["glpi","package","self-hosted","two-factor-auth"],"not_affected_if":["no-2fa-reliance","version-11.0.8-or-later"],"how_to_check":"- Check the installed GLPI version in the admin interface or in the `version` file at the install root; affected versions are `11.0.0` through `11.0.8`\n- Confirm whether two-factor authentication is enforced for users on the instance","fix":"- GLPI `11.0.8`","status":"open","published_at":"2026-11-04T23:17:46+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:38+00:00","updated_at":"2026-11-05T00:31:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T00:31:38Z","model":"claude-haiku-5-5","output":{"fix":"- GLPI `11.0.8`","reach":"internet","title":"GLPI: crafted login URL skips two-factor authentication check","impact":"high","summary":"GLPI, a free asset and IT management application, lets an unauthenticated user use a crafted URL during login to skip the one-time-password check. An attacker who knows a valid password can therefore get into accounts without the second factor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["glpi","self-hosted","two-factor-auth"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker logs in as a user, bypassing two-factor authentication","analyst_note":"","how_to_check":"- Check the installed GLPI version in the admin interface or in the `version` file at the install root; affected versions are `11.0.0` through `11.0.8`\n- Confirm whether two-factor authentication is enforced for users on the instance","plain_action":"","needs_analyst":false,"not_affected_if":["version-11.0.8-or-later","no-2fa-reliance"],"who_is_affected":"Self-hosted GLPI instances from 11.0.0 up to 11.0.8 that use the login form are exposed, since the flaw sits in the login phase. Instances already on 11.0.8 or later are not affected by this issue.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00067,"input_tokens":4237,"output_tokens":493,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-52848':13A,16A '11.0.0':79C '11.0.8':81C,112C 'account':63B 'applic':33B 'asset':29B,72C 'attack':53B 'auth':25B 'authent':9A,105C 'check':10A,51B 'could':89C 'craft':2A,40B,92C 'cve':11A,14A 'defeat':101C 'factor':8A,24B,67B,104C 'fix':109C 'free':28B,71C 'get':61B 'glpi':1A,17B,26B,68C 'host':21B 'issu':107C 'know':55B 'let':34B 'login':3A,43B,84C 'manag':32B,75C 'one':48B,97C 'one-time-password':47B,96C 'packag':18B,77C 'password':50B,58B,99C 'phase':85C 'second':66B 'self':20B 'self-host':19B 'skip':5A,45B,95C 'softwar':76C 'therefor':60B 'time':49B,98C 'two':7A,23B,103C 'two-factor':6A,102C 'two-factor-auth':22B 'unauthent':36B,87C 'url':4A,41B,93C 'use':38B,90C 'user':37B,88C 'valid':57B 'verif':100C 'version':111C 'without':64B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted GLPI instances from 11.0.0 up to 11.0.8 that use the login form are exposed, since the flaw sits in the login phase. Instances already on 11.0.8 or later are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","glpi","package","selfhosted","twofactorauth"],"campaign_type":null,"first_public_at":"2026-07-27T07:54:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52848","severity":null,"published_at":"2026-11-04T23:17:46+00:00","modified_at":"2026-11-04T23:17:46+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null}],"documents":[{"id":71468,"url":"https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71466,"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71470,"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-27T07:54:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}