GLPI has a MFA bypass

Successful exploitation of CVE-2026-25937 allows an attacker to completely compromise a user's GLPI account, effectively gaining access to all data and functionalities associated with that account. This includes the ability to view, modify, and delete assets, users, and other critical IT management information. The impact is particularly severe in environments where GLPI is used for sensitive data management or critical infrastructure oversight. Lateral movement within the network is possible if the compromised account has elevated privileges or access to other systems. The blast radius extends to any data or systems accessible through the compromised GLPI account.

Organizations heavily reliant on GLPI for asset and IT management are at significant risk. Specifically, those using GLPI versions 11.0.0 through 11.0.5 and lacking robust password policies or MFA implementations are particularly vulnerable. Shared hosting environments where multiple users share a single GLPI instance also face increased risk.

• php: Examine GLPI application logs for unusual authentication attempts or successful logins from unexpected IP addresses.

 grep "authentication failed" /var/log/glpi/application.log

• php: Check for unauthorized modifications to user accounts or asset records within GLPI.

 # (Requires GLPI CLI access) 
 glpi-cli user:list --all | grep -i "unauthorized"

• generic web: Monitor GLPI login endpoints for suspicious activity, such as repeated failed login attempts followed by a successful login. • generic web: Review GLPI access logs for unusual user agent strings or requests from unfamiliar locations.

1. 2026-03-17Disclosure

   disclosure

1. Reserviert2026-02-09
2. Veröffentlicht2026-03-17
3. Geändert2026-03-19
4. EPSS aktualisiert2026-03-25

The primary mitigation for CVE-2026-25937 is to immediately upgrade GLPI to version 11.0.6 or later. If upgrading is not immediately feasible, consider implementing stricter password policies and reviewing user access controls to limit the potential impact of a compromised account. While not a direct fix, enabling more robust MFA methods (e.g., hardware tokens, biometric authentication) can provide an additional layer of security. After upgrading, verify the fix by attempting to authenticate with known valid credentials and confirming that MFA is enforced as expected.