---
id: "CVE-2026-52848"
kind: "vulnerability"
aliases: ["CVE-2026-52848"]
title: "GLPI: crafted login URL skips two-factor authentication check"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["glpi", "package", "self-hosted", "two-factor-auth"]
not_affected_if: ["no-2fa-reliance", "version-11.0.8-or-later"]
published_at: "2026-11-04T23:17:46+00:00"
first_seen_at: "2026-11-05T00:30:59+00:00"
updated_at: "2026-11-05T00:31:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52848", "first_seen_at": "2026-11-05T00:30:59+00:00"}]
exploit_sources: []
---

# GLPI: crafted login URL skips two-factor authentication check

GLPI, a free asset and IT management application, lets an unauthenticated user use a crafted URL during login to skip the one-time-password check. An attacker who knows a valid password can therefore get into accounts without the second factor.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GLPI version in the admin interface or in the `version` file at the install root; affected versions are `11.0.0` through `11.0.8`
- Confirm whether two-factor authentication is enforced for users on the instance

## Fix

- GLPI `11.0.8`

## Timeline

- 2026-11-05T00:30:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-52848

## Documents

- [advisory] Vendor advisory: github.com https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch
- [fix] Patch: github.com https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd
- [fix] Release notes: github.com https://github.com/glpi-project/glpi/releases/tag/11.0.8

## From the sources

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_