CRITICAL 9.2 NVD
CVE-2026-52848
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to sk
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.
References
- https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd
- https://github.com/glpi-project/glpi/releases/tag/11.0.8
- https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-11-04 via NVD.
Risk Timeline
CVE Disclosed2026-11-04 · 0 days ago
Remediation Resources
vulnfeed aggregates 16578 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.