CVE-2026-52848: 
GLPI vulnerability analysis and mitigation

CVE-2026-52848 is a critical multi-factor authentication (MFA) bypass vulnerability in GLPI, a free open-source IT asset management platform. During the login phase, an unauthenticated user can craft a specially formed URL to skip one-time password (OTP) verification, effectively rendering two-factor authentication protections inoperative. The vulnerability affects GLPI versions 11.0.0 through 11.0.7 and was fixed in version 11.0.8, released on June 24, 2026. The advisory was published on July 27, 2026, and the CVE carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, GLPI Release).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The root cause lies in insufficient enforcement of the OTP verification step during the login flow — specifically, the application fails to properly validate that the MFA challenge has been completed before granting session access when a crafted URL is supplied. An unauthenticated attacker with network access can exploit this by manipulating the login URL to bypass the OTP step entirely, requiring no privileges or user interaction, though some attack preconditions (AT:P) are noted in the CVSS scoring. The fix, committed in 5ec327bfa78d12075e7224cfca5383b226f5babd, also corrected a related flaw in the isAPI() function where $_SERVER['REQUEST_URI'] was used directly instead of the properly parsed path, which could have contributed to the bypass (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to gain full unauthorized access to any GLPI account that has MFA enabled, completely defeating the second-factor protection. Since GLPI manages IT assets, helpdesk tickets, user accounts, and sensitive infrastructure data, account compromise can lead to exposure of confidential asset inventories, credential stores, and internal network topology. Depending on the compromised account's privilege level, an attacker could escalate to administrative access, manipulate IT records, or use GLPI as a pivot point for further lateral movement within the organization (GitHub Advisory, Feedly).

As of the time of publication, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is reported at 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity, network-accessible attack vector, and no privilege requirement make this vulnerability highly automatable and attractive to threat actors targeting IT management platforms. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing GLPI instances running versions 11.0.0–11.0.7 using search engines (Shodan, Censys) or by probing the GLPI login page for version indicators.
2. Identify MFA-protected accounts: Attempt to log in with known or guessed credentials (e.g., default accounts, credential stuffing) to trigger the MFA/OTP challenge page, confirming MFA is enforced.
3. Craft bypass URL: Construct a specially crafted URL that manipulates the login flow's path or parameters to skip the OTP verification step. Based on the fix, this likely involves injecting path segments (e.g., referencing api.php or apirest.php) into the REQUEST_URI to cause the application to misidentify the request context and skip the MFA enforcement check.
4. Submit crafted request: Send the crafted HTTP request to the GLPI login endpoint, supplying valid primary credentials (username/password) but bypassing the OTP step via the URL manipulation.
5. Gain unauthorized access: The server grants an authenticated session without completing MFA verification, providing full access to the GLPI account and its associated data and functions (GitHub Advisory, Fix Commit).

• Network: Unusual HTTP requests to the GLPI login endpoint with atypical URL structures, particularly those containing api.php or apirest.php path segments within non-API login flows; successful login events from unexpected IP addresses or geolocations.
• Logs: GLPI authentication logs showing successful logins for MFA-enabled accounts without a corresponding OTP verification event; login sessions established without the expected MFA challenge/response sequence in application logs.
• Logs: Web server access logs showing POST requests to the login endpoint with crafted or malformed REQUEST_URI values that include API-related path components.
• Process/Session: Active GLPI sessions for accounts that should require MFA, originating from IPs not previously associated with those accounts, especially during off-hours.

The primary remediation is to upgrade GLPI to version 11.0.8 or later, which contains the fix for this vulnerability (GLPI Release). Organizations unable to upgrade immediately should implement network-level access controls to restrict access to the GLPI application to trusted IP ranges only, reducing the attack surface. Additionally, administrators should audit authentication logs for suspicious login activity on MFA-enabled accounts and consider temporarily disabling external access to the GLPI instance until patching is complete. Contacting GLPI security at glpi-security@ow2.org for further guidance is also recommended (GitHub Advisory).

The vulnerability was reported by security researchers assakafpix and SebSept, who are credited in the official GitHub Security Advisory (GitHub Advisory). The GLPI project released version 11.0.8 as a dedicated security release addressing this and 15 other vulnerabilities, recommending immediate upgrade for all users (GLPI Release). The release received positive community engagement on GitHub, with multiple reactions indicating awareness within the GLPI user community. Threat intelligence aggregators such as CTI Pilot covered the release in their daily and weekly vulnerability rollups shortly after disclosure.