Untriaged
Permalink
CVE-2026-25937
6.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): NONE
GLPI has a MFA bypass
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-2g3p-vwp2-7qxm x_refsource_CONFIRM
Affected products
glpi
- ==>= 11.0.0, < 11.0.6
Package maintainers
-
@liberodark liberodark <liberodark@gmail.com>