Is CVE-2026-52848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52848 being exploited in the wild.

How severe is CVE-2026-52848?

Informational severity, published 4 November 2026.

Which products and versions are affected?

GLPI Project GLPI 11.0.0 to 11.0.7.

Is there a fix for CVE-2026-52848?

Yes: fixed in 11.0.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52848 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-52848?

Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52848: GLPI 2FA bypass in login via crafted URL

CVE-2026-52848 · Severity: info · Published 2026-11-04

GLPI is a free IT asset and lifecycle management platform used by organizations to track and manage hardware, software, and IT services. An unauthenticated attacker could bypass two-factor authentication during login by crafting a malicious URL, gaining unauthorized access to accounts even when MFA is enabled. This vulnerability affects versions 11.0.0 through 11.0.7 and is fixed in 11.0.8.

Technologies: GLPI Project GLPI. Vendors: GLPI Project.

Quick answers

Is CVE-2026-52848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52848 being exploited in the wild.
How severe is CVE-2026-52848?: Informational severity, published 4 November 2026.
Which products and versions are affected?: GLPI Project GLPI 11.0.0 to 11.0.7.
Is there a fix for CVE-2026-52848?: Yes: fixed in 11.0.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52848 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-52848?: Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 11.0.8

Technical details

During the login phase in GLPI versions 11.0.0–11.0.7, insufficient validation of the one-time password (OTP) verification flow allows an unauthenticated attacker to bypass 2FA through a specially crafted URL. The vulnerability is in the authentication logic that handles OTP verification, allowing attackers to skip this security check entirely. A network-accessible attacker requires no authentication or user interaction to exploit this, and the fix was implemented in version 11.0.8.

Affected products

GLPI Project GLPI 11.0.0 to 11.0.7

Timeline

2026-11-04: disclosed
2026-06-24: patched: Version 11.0.8 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.