Vulnerability
CVE-2026-49470
Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.
- Sharing
- PUBLIC-OSINT
- Confidence
- 100
- Source
- The CVE Program
- Updated
- 26/09/2026 02:10
Description
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.
Aliases and classifications
CWE-307Improper Restriction of Excessive Authentication Attempts
Minimised technical details
No raw data- cisa kev
- False
Provenance
Public references
- https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/releases/tag/11.0.8 - https://github.com/glpi-project/glpi/commit/19a0e81a2b09fee43b3e2a603639fc9b61360c73
https://github.com/glpi-project/glpi/commit/19a0e81a2b09fee43b3e2a603639fc9b61360c73 - https://github.com/glpi-project/glpi/security/advisories/GHSA-mcv8-4hfg-5x2x
https://github.com/glpi-project/glpi/security/advisories/GHSA-mcv8-4hfg-5x2x
EudorIA correlation
Intel catalogue
The vulnerability is also available in the EudorIA editorial catalogue.
Open EudorIA analysisPresence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.