{"id":"CVE-2026-52848","published":"2026-11-04T23:17:46.560","lastModified":"2026-11-04T23:17:46.693","description":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-288"],"vendors":[],"products":[],"references":[{"url":"https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd","tags":[]},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","tags":[]},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch","tags":[]}],"exploitRefs":[{"url":"https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd","tags":[]},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","tags":[]},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch","tags":[]}],"hasPoc":true,"ai":null}