CVE-2026-49470: GLPI TOTP Auth Bypass Vulnerability

CVE-2026-49470 Overview

GLPI is a free asset and IT management software package used by organizations to track inventory, tickets, and infrastructure. CVE-2026-49470 affects GLPI versions 11.0.0 through 11.0.7, where the time-based one-time password (TOTP) verification endpoint lacks per-user rate limiting on failed submissions. An attacker who already holds a user's primary credentials can repeatedly submit TOTP guesses against the multi-factor authentication (MFA) verification flow. This permits brute-force compromise of the second factor and subsequent account takeover. The weakness is classified under [CWE-307: Improper Restriction of Excessive Authentication Attempts]. GLPI version 11.0.8 contains the fix.

Critical Impact
An attacker with valid primary credentials can brute-force the six-digit TOTP second factor, bypassing MFA protection and taking over the targeted GLPI account.

Affected Products

GLPI 11.0.0 through 11.0.7
GLPI MFA verification endpoint (TOTP flow)
Deployments relying on TOTP as the sole secondary authentication factor

Discovery Timeline

2026-09-25 - CVE-2026-49470 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-49470

Vulnerability Analysis

The vulnerability resides in GLPI's MFA controller, which validates TOTP codes submitted during the post-password authentication step. The controller accepts TOTP submissions without tracking the number of failed attempts per user identifier. An attacker who has already compromised the primary password can script repeated POST requests to the verification endpoint. Because TOTP codes are six digits, the effective keyspace is one million values with a 30-second rotation window, which is tractable with sustained automated submission.

Successful exploitation grants full authenticated access to the targeted account. In GLPI environments, compromised accounts can expose asset inventories, ticket data, and administrative functions depending on the role of the targeted user.

Root Cause

The MFAController processed TOTP verification requests without invoking a rate limiter before calling verifyBackupCodeForUser or the TOTP verification routine. No throttling, lockout, or exponential backoff was applied per users_id, so brute-force attempts were not detected or blocked at the application layer.

Attack Vector

The attack is network-reachable and requires valid primary credentials for the targeted user. The attacker scripts repeated TOTP submissions against the MFA endpoint until a valid code is accepted. No user interaction is required beyond possession of the first factor.

php

// Patch applied in src/Glpi/Controller/Security/MFAController.php
$query_params = isset($pre_auth_data['redirect']) ? sprintf('redirect=%s', $pre_auth_data['redirect']) : '';

if (!($in_grace_period && $request->request->has('skip_mfa'))) {
    $totp->checkMFARateLimit($users_id);

    if (
        !(
            (isset($backup_code) && $totp->verifyBackupCodeForUser($backup_code, $users_id))

Source: GLPI commit 19a0e81a. The patch adds a checkMFARateLimit($users_id) call before TOTP or backup code verification and introduces symfony/rate-limiter as a composer dependency.

Detection Methods for CVE-2026-49470

Indicators of Compromise

High volume of POST requests from a single source to the GLPI MFA verification endpoint within a short window
Repeated authentication log entries showing successful password validation followed by many failed TOTP submissions for the same user
Successful MFA validation immediately after a burst of failed TOTP attempts for the same users_id

Detection Strategies

Parse GLPI application and web server logs for a ratio of failed-to-successful MFA submissions above a defined threshold per user per hour.
Correlate successful primary authentication events with subsequent high-cardinality TOTP submission patterns from the same session or IP.
Alert when a single IP address targets MFA verification for multiple accounts, which indicates credential-stuffing combined with brute-force.

Monitoring Recommendations

Forward GLPI web server and application logs to a centralized logging platform for retention and query.
Enable alerting on authentication anomalies, including spikes in /front/login.php or MFA endpoint POST volume.
Review user session histories for accounts that completed MFA within an unusually short interval after many failures.

How to Mitigate CVE-2026-49470

Immediate Actions Required

Upgrade GLPI to version 11.0.8, which introduces per-user rate limiting on the MFA verification endpoint.
Audit recent authentication logs for accounts that experienced abnormal volumes of failed TOTP submissions followed by successful logins.
Rotate credentials and TOTP secrets for any accounts suspected of compromise.

Patch Information

The fix is included in GLPI Release 11.0.8. The code change is documented in commit 19a0e81a and the vendor advisory GHSA-mcv8-4hfg-5x2x. The patch adds the symfony/rate-limiter component and calls checkMFARateLimit($users_id) before TOTP or backup code verification.

Workarounds

Place GLPI behind a web application firewall (WAF) or reverse proxy with request rate limiting on the MFA verification path.
Enforce short-lived account lockouts at the perimeter when repeated POSTs to the MFA endpoint originate from the same source IP or session.
Require strong, unique primary passwords and monitor for credential stuffing to reduce the pool of accounts an attacker can target.

bash

# Example NGINX rate limit for the GLPI MFA verification path
http {
    limit_req_zone $binary_remote_addr zone=glpi_mfa:10m rate=5r/m;

    server {
        location ~ ^/front/.*mfa.* {
            limit_req zone=glpi_mfa burst=5 nodelay;
            proxy_pass http://glpi_backend;
        }
    }
}