All vulnerabilities
CVE-2026-49470GHSA-mcv8-4hfg-5x2x

GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

glpi-project glpi
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.0.8Fixed versionGitHub
Published25 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.

Text from CVE List

Affected versions 2

  • glpiaffected: >= 11.0.0, < 11.0.8CVE List
  • glpi, glpi>= 11.0.0GitHub

References 3