CVE-2026-25937: GLPI MFA Bypass Vulnerability

CVE-2026-25937 Overview

CVE-2026-25937 is an authentication bypass vulnerability in GLPI, a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass Multi-Factor Authentication (MFA) and take over user accounts. This vulnerability is classified as CWE-287 (Improper Authentication), indicating a fundamental flaw in the authentication mechanism.

Critical Impact

Attackers with valid user credentials can completely bypass MFA protections, rendering the additional security layer ineffective and enabling full account takeover.

Affected Products

• GLPI versions 11.0.0 through 11.0.5
• GLPI IT Asset Management deployments with MFA enabled
• Organizations relying on GLPI's MFA for privileged account protection

Discovery Timeline

• 2026-03-18 - CVE-2026-25937 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-25937

Vulnerability Analysis

This authentication bypass vulnerability allows attackers to circumvent Multi-Factor Authentication controls in GLPI installations. The flaw exists in how GLPI handles the authentication flow when MFA is configured. An attacker who has obtained valid user credentials through phishing, credential stuffing, or other means can exploit this vulnerability to gain access to accounts without completing the MFA challenge.

The vulnerability is particularly concerning because MFA is typically deployed as a critical security control to protect against credential theft. When this protection can be bypassed, organizations lose a significant layer of defense against account compromise.

Root Cause

The root cause is classified as CWE-287: Improper Authentication. The GLPI application fails to properly enforce the MFA verification step under certain conditions, allowing the authentication process to complete with only the primary credentials. This represents a logic flaw in the authentication workflow where the MFA validation can be skipped or bypassed entirely.

Attack Vector

The attack is network-based and requires the attacker to possess valid user credentials. The exploitation path involves:

1. Attacker obtains valid username and password combination through credential theft techniques
2. Attacker initiates authentication to the GLPI instance
3. Attacker exploits the MFA bypass flaw to skip the second factor verification
4. Attacker gains full access to the victim's GLPI account

The vulnerability mechanism involves improper session state handling during the MFA challenge phase. When a user authenticates with valid credentials, the system should enforce completion of the MFA challenge before granting access. However, due to the flaw in the authentication flow, an attacker can manipulate the authentication process to bypass this requirement entirely.

For complete technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25937

Indicators of Compromise

• Successful authentication events without corresponding MFA challenge completion logs
• Login sessions originating from unusual geographic locations or IP addresses
• Multiple authentication attempts followed by successful logins without MFA verification
• Anomalous user activity patterns following authentication events

Detection Strategies

• Monitor authentication logs for sessions that bypass the MFA verification step
• Implement alerting for authentication events missing expected MFA challenge records
• Deploy SIEM rules to correlate login events with MFA verification timestamps
• Review access logs for accounts that should have MFA enforced but show single-factor authentication

Monitoring Recommendations

• Enable verbose logging for all authentication events in GLPI
• Configure real-time alerting for authentication anomalies
• Regularly audit MFA enrollment status and authentication patterns
• Implement user behavior analytics to detect account takeover attempts

How to Mitigate CVE-2026-25937

Immediate Actions Required

• Upgrade GLPI installations to version 11.0.6 or later immediately
• Audit recent authentication logs for signs of MFA bypass exploitation
• Force password resets for high-privilege accounts as a precautionary measure
• Review and validate MFA configurations across all user accounts

Patch Information

The GLPI development team has addressed this vulnerability in version 11.0.6. Organizations should prioritize upgrading from any affected version (11.0.0 through 11.0.5) to the patched release. The security fix ensures proper enforcement of MFA verification during the authentication workflow.

For detailed patch information and upgrade instructions, consult the GLPI Security Advisory.

Workarounds

• Implement network-level access controls to restrict GLPI access to trusted IP ranges
• Deploy a Web Application Firewall (WAF) with rules to monitor authentication patterns
• Consider temporarily disabling external access to GLPI until the patch can be applied
• Implement additional session monitoring and anomaly detection at the network level

# Example: Restrict GLPI access to internal networks using iptables
# Apply these rules on the GLPI server to limit exposure
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP