GLPI Two-Factor Authentication Bypass (CVE-2026-52848)

CVE-2026-52848 is an authentication bypass in GLPI, the open source asset and IT management package. The CVE record says that during the login phase an unauthenticated user can use a crafted URL to skip one-time-password verification. That defeats two-factor authentication on the affected releases.

The record files the weakness under CWE-288, authentication bypass using an alternate path or channel. GitHub, the CNA, titles it "MFA bypass" and scores it CVSS 4.0 9.2 Critical. The GLPI advisory GHSA-hgr8-qvp5-mhch says any user can use a self-crafted URL to make the two-factor protection ineffective.

What the Fix Changed

The only commit the CVE record links changes how GLPI decides whether a request is an API call. The old isAPI() function tested whether the request URI contained api.php or apirest.php anywhere. The new code checks whether the request path starts with one of them.

The advisory does not describe the mechanism, so this is our reading. A URL that only contained api.php may have been treated as an API request, and API requests follow a different login path. We have not traced the login code, so treat this as a lead for your own review.

Fixed Since June, Recorded in November

GLPI 11.0.8 was published on 24 June 2026, and the fix commit is dated the same day. The advisory carries the date 27 July 2026, while the CVE record was published on 4 November 2026. Anyone who patched in June or July already has the fix.

The 11.0.8 release is a security release with 16 fixes. It lists two Critical items, this MFA bypass and a remote code execution through form import (CVE-2026-48482). It also lists an account takeover through two-factor brute force (CVE-2026-49470).

What NVD and CISA KEV Say

NVD published the entry on 4 November 2026 and lists it as Deferred, with the GitHub CVSS 4.0 score as a secondary source. CISA's KEV catalog, version 2026.11.04, does not list the CVE. Our multi-factor authentication entry explains what the second factor protects.

The CVE record and the GLPI advisory list GLPI from 11.0.0 up to, but not including, 11.0.8. That means 11.0.0 through 11.0.7. The fixed release is 11.0.8, which the record, the advisory and the release page all name.

The record lists no other branch. The record does not say whether the 10.x line is affected, so we recommend checking the GLPI project's own release notes for the branch you run.

The advisory places the flaw in the login phase and says it makes the two-factor protection ineffective. We recommend treating any instance that relies on two-factor authentication as exposed until it runs 11.0.8. Our vulnerability management guide covers how to track a rollout like this.