CVE-2025-23046: GLPI Auth Bypass Vulnerability

CVE-2025-23046 Overview

CVE-2025-23046 is an authentication bypass vulnerability affecting GLPI, a widely-used free asset and IT management software package. The vulnerability exists in versions starting from 9.5.0 up to (but not including) version 10.0.18 when a "Mail servers" authentication provider is configured to use an OAuth connection provided by the OauthIMAP plugin.

This flaw allows unauthorized users to connect to GLPI using any username for which an OAuth authorization has already been established, effectively bypassing the authentication mechanism entirely.

Critical Impact

Attackers can gain unauthorized access to GLPI instances by exploiting the OAuth authentication flow, potentially compromising sensitive IT asset management data and system configurations.

Affected Products

• GLPI versions 9.5.0 through 10.0.17
• GLPI installations using OauthIMAP plugin for Mail server authentication
• Any GLPI deployment with OAuth-enabled Mail servers authentication provider

Discovery Timeline

• 2025-02-25 - CVE-2025-23046 published to NVD
• 2025-02-28 - Last updated in NVD database

Technical Details for CVE-2025-23046

Vulnerability Analysis

The vulnerability stems from improper authentication validation when using the OauthIMAP plugin with GLPI's Mail servers authentication provider. When OAuth-based authentication is configured, the system fails to properly verify whether the connecting user actually owns or has authorized access to the OAuth credentials being used.

The flaw allows an attacker to authenticate to GLPI by simply providing a username that has previously completed OAuth authorization. The system incorrectly trusts the username without validating that the current session belongs to the legitimate owner of those OAuth credentials.

This authentication bypass is classified under CWE-303 (Incorrect Implementation of Authentication Algorithm), highlighting the fundamental flaw in how the authentication logic validates user identity in OAuth scenarios.

Root Cause

The root cause is an incorrect implementation of the authentication algorithm within the OauthIMAP plugin integration. Specifically, the authentication flow does not properly bind OAuth tokens to specific user sessions or verify token ownership before granting access. When a user presents a username with existing OAuth authorization, the system assumes the request is legitimate without performing adequate verification of the requester's identity.

Attack Vector

The attack is network-based, requiring the attacker to have network access to the GLPI instance. The exploitation scenario involves:

1. The attacker identifies a GLPI instance configured with OauthIMAP plugin for Mail server authentication
2. The attacker discovers or guesses a valid username that has previously authorized OAuth access
3. The attacker initiates an authentication request using that username
4. Due to the flawed validation logic, GLPI grants access to the attacker without proper credential verification

The vulnerability requires that the target environment has the specific OAuth configuration in place, adding some complexity to successful exploitation. However, once these preconditions are met, the attack can be executed remotely without user interaction.

Detection Methods for CVE-2025-23046

Indicators of Compromise

• Unexpected successful login events for accounts that should require OAuth re-authentication
• Multiple login attempts from different source IPs using the same OAuth-enabled username
• Authentication logs showing successful access without corresponding OAuth token generation events
• Anomalous access patterns to GLPI administrative functions or sensitive asset data

Detection Strategies

• Review GLPI authentication logs for accounts using OAuth Mail server authentication that show successful logins without legitimate user activity
• Monitor for authentication patterns where users appear to access GLPI from unusual geographic locations or IP addresses
• Implement alerting for multiple concurrent sessions using the same OAuth-enabled credentials
• Cross-reference GLPI access logs with OAuth provider logs to identify mismatched authentication events

Monitoring Recommendations

• Enable verbose logging for all authentication events in GLPI, particularly for Mail server authentication providers
• Deploy network monitoring to detect unusual traffic patterns targeting GLPI authentication endpoints
• Implement user behavior analytics to identify anomalous access patterns that may indicate credential abuse
• Regularly audit the list of users with OAuth authorization to identify potentially compromised accounts

How to Mitigate CVE-2025-23046

Immediate Actions Required

• Upgrade GLPI to version 10.0.18 or later immediately
• If immediate upgrade is not possible, disable any Mail servers authentication provider configured to use OAuth connections via the OauthIMAP plugin
• Review authentication logs for signs of unauthorized access to accounts using OAuth authentication
• Force re-authentication for all users that were using OAuth-based Mail server authentication

Patch Information

GLPI has released version 10.0.18 which contains a patch for this vulnerability. Organizations should upgrade to this version as soon as possible. For detailed information about the fix, refer to the GitHub Release Notes for version 10.0.18 and the GitHub Security Advisory GHSA-vfxc-qg3v-j2r5.

Workarounds

• Disable any "Mail servers" authentication provider that is configured to use an OAuth connection provided by the OauthIMAP plugin until the patch can be applied
• Temporarily switch to alternative authentication methods that do not rely on the vulnerable OAuth flow
• Implement network-level access controls to restrict GLPI access to trusted IP ranges
• Enable multi-factor authentication as an additional security layer if available

# Verify GLPI version to confirm patch status
grep -i "version" /path/to/glpi/inc/define.php

# Review authentication provider configuration
# Navigate to Setup > Authentication in GLPI admin panel
# Disable OAuth-configured Mail servers until patched