BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-52848GLPI: MFA bypass

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

9.2 CRITICALEPSS 0.37%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
9.2CRITICAL4.0GitHub_M (CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Details

CVE ID
CVE-2026-52848
Status
Deferred
Assigner (CNA)
GitHub_M
Published
Nov 4, 2026
Last modified
2026-11-04 23:17 UTC
Weaknesses
  • CWE-288 · Authentication Bypass Using an Alternate Path or Channel

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 09:28 UTC.