Brute Force Vulnerability in GLPI IT Management Software
CVE-2026-49470

7.7HIGH

Key Information:

Vendor

GLPI Project
Status
Glpi
Vendor
CVE Published:
25 September 2026

What is CVE-2026-49470?

The time-based one-time password (TOTP) verification endpoint in GLPI versions 11.0.0 to 11.0.8 is susceptible to a brute force attack due to a lack of constraints on failed submissions per user. If an attacker acquires a user's primary credentials, they can repeatedly attempt TOTP values, potentially compromising the second factor of authentication and leading to unauthorized account access. This vulnerability was addressed in version 11.0.8.

Affected Version(s)

glpi >= 11.0.0, < 11.0.8

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/19a0e81a2b09f...
x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/11.0.8
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.