# CVE-2026-52848: GLPI 2FA bypass in login via crafted URL

Source: https://junglewise.ai/threats/cve-2026-52848-glpi-is-a-free-asset-and-it-management-software-package-from-11-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-52848 · Severity: info · Published 2026-11-04

GLPI is a free IT asset and lifecycle management platform used by organizations to track and manage hardware, software, and IT services. An unauthenticated attacker could bypass two-factor authentication during login by crafting a malicious URL, gaining unauthorized access to accounts even when MFA is enabled. This vulnerability affects versions 11.0.0 through 11.0.7 and is fixed in 11.0.8.

Technologies: [GLPI Project GLPI](https://junglewise.ai/threats/technologies/glpi-project-glpi). Vendors: [GLPI Project](https://junglewise.ai/threats/vendors/glpi-project).

## Quick answers

**Is CVE-2026-52848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52848 being exploited in the wild.

**How severe is CVE-2026-52848?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** GLPI Project GLPI 11.0.0 to 11.0.7.

**Is there a fix for CVE-2026-52848?** Yes: fixed in 11.0.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52848 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-52848?** Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.0.8

## Technical details

During the login phase in GLPI versions 11.0.0–11.0.7, insufficient validation of the one-time password (OTP) verification flow allows an unauthenticated attacker to bypass 2FA through a specially crafted URL. The vulnerability is in the authentication logic that handles OTP verification, allowing attackers to skip this security check entirely. A network-accessible attacker requires no authentication or user interaction to exploit this, and the fix was implemented in version 11.0.8.

## Affected products

- GLPI Project GLPI 11.0.0 to 11.0.7

## Timeline

- 2026-11-04: disclosed
- 2026-06-24: patched: Version 11.0.8 released

## References

- [https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd](https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd)
- [https://github.com/glpi-project/glpi/releases/tag/11.0.8](https://github.com/glpi-project/glpi/releases/tag/11.0.8)

## Related threats

- [GLPI authorization bypass in document access](https://junglewise.ai/threats/cve-2026-57152-glpi-is-a-free-asset-and-it-management-software-package-from-0-85)
- [GLPI authorization bypass in knowledge base visibility](https://junglewise.ai/threats/cve-2026-53631-glpi-is-a-free-asset-and-it-management-software-package-from-0-83)
- [GLPI SQL injection in dropdown values endpoint](https://junglewise.ai/threats/cve-2026-47678-glpi-is-a-free-asset-and-it-management-software-package-from-9-4)
- [GLPI privilege escalation in account cloning](https://junglewise.ai/threats/cve-2026-121559-glpi-10-0-0-before-10-0-28-and-11-0-0-before-11-0-10-contains-a)
- [GLPI missing authorization in ajax/map.php](https://junglewise.ai/threats/cve-2026-108726-glpi-through-12-0-0-contains-a-missing-authorization)