External risk intelligence

GLPI Two-Factor Authentication Bypass via Crafted URL

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-52848

GLPI is an IT asset management software commonly deployed as a web-based application accessible over a network. Since this vulnerability affects the login phase and involves authentication, it is highly characteristic of web services that are frequently exposed to the internet or wide internal networks to allow staff and administrators to manage IT assets remotely.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability allows an unauthenticated user to bypass two-factor authentication on GLPI, an IT asset management system. At a high level, this could potentially expose sensitive IT infrastructure information.

Bypasses multi-factor authentication for IT management software.
Relevant if you use GLPI for IT asset tracking.
Confirm if your organization uses GLPI and confirm relevance.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a specially crafted URL during the login process to bypass two-factor authentication checks. This bypass could allow an unauthenticated user to gain unauthorized access to the system by circumventing one-time password verification.

Unauthenticated network access required.
Crafted URL bypasses OTP verification.
Unauthorized system access risk.

Live Threat

Current exploitation, exposure, and threat context

During the login phase, an unauthenticated user could bypass two-factor authentication by crafting a specific URL, potentially granting unauthorized access to the system. This could affect system data and service behavior when supported by the advisory.

System access and data could be at risk.
Exploitation may occur via a crafted URL.
Unauthorized access to system data is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners or platform teams responsible for GLPI deployments should prioritize confirming where this asset is deployed and its business criticality. The next practical step is to identify the accountable owner and then plan remediation by assessing risk, which may involve coordinating with vendors or scheduling maintenance windows.

GLPI owners and platform teams.
Confirm GLPI asset reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GLPI?

GLPI is an open-source software package designed for IT asset and service management. Organizations use it to track inventory, manage hardware and software lifecycles, and handle helpdesk ticketing workflows, typically through a web-based interface.

What does CWE-288 mean for CVE-2026-52848?

CWE-288, or Authentication Bypass Using an Alternate Path or Channel, describes a weakness where a system's security controls can be circumvented. In this CVE, the vulnerability allows an attacker to skip the intended two-factor authentication process during the login phase.

How is this authentication bypass triggered?

An unauthenticated user triggers the flaw by accessing the login page with a specially crafted URL. This bypass occurs specifically during the initial authentication steps. Standard, legitimate login attempts that do not utilize this specific URL structure do not trigger the bypass.

Is my GLPI instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of concern because GLPI is commonly deployed as a web application accessible over a network. If your instance is reachable via the internet or wide internal networks, it faces a higher profile for this type of authentication-based vulnerability.

How do I secure my environment against this issue?

The primary response is to update your GLPI installation to version 11.0.8 or later. If you manage these systems, identify the deployment, confirm its accessibility, and coordinate with your team to schedule the update to apply the vendor-provided fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.