CVE-2026-49470

Published: Set 25, 2026 Last Modified: Set 25, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.

307

Improper Restriction of Excessive Authentication Attempts

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/glpi-project/glpi/commit/19a0e81a2b09fee…
https://github.com/glpi-project/glpi/commit/19a0e81a2b09fee43b3e2a603639fc9b613…
https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/security/advisories/GH…
https://github.com/glpi-project/glpi/security/advisories/GHSA-mcv8-4hfg-5x2x