What is the CVSS score of CVE-2026-25937?

CVE-2026-25937 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Glpi are affected by CVE-2026-25937?

Organizations using version 11.0.0 and should be aware of notable risk from CVE-2026-25937, a improper authentication vulnerability rated CVSS 6.5.

How to fix or mitigate CVE-2026-25937?

Within 30 days: Identify affected systems running version 11.0.0 and and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Glpi CVE-2026-25937

MEDIUM

Improper Authentication (CWE-287)

2026-03-17 GitHub_M

Authentication Bypass Glpi

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 23:30 vuln.today

CVE Published

Mar 17, 2026 - 23:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.

AnalysisAI

GLPI versions 11.0.0 through 11.0.5 contain an authentication bypass vulnerability that allows an attacker with knowledge of a user's credentials to circumvent multi-factor authentication (MFA) and gain unauthorized account access. This vulnerability affects the GLPI asset and IT management software and is classified as CWE-287 (Improper Authentication), with a CVSS score of 6.5 indicating medium severity. The issue has been patched in version 11.0.6, and while no active KEV listing or public proof-of-concept is noted in available sources, the authentication bypass nature suggests moderate exploitation probability.

Technical ContextAI

GLPI is a free and open-source asset and IT management platform written in PHP that handles critical infrastructure asset tracking and IT operations. The vulnerability resides in the authentication mechanism between versions 11.0.0 and 11.0.5, specifically in how MFA validation is performed after initial credential verification. This falls under CWE-287 (Improper Authentication), which encompasses flaws where authentication logic fails to properly validate user identity or session state. The root cause likely involves insufficient validation of MFA status during session establishment or token generation, allowing an attacker who possesses valid credentials to bypass the second factor authentication step. The affected product is identified via CPE as cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*, indicating all configurations of GLPI within the vulnerable version range are impacted.

RemediationAI

Upgrade GLPI to version 11.0.6 or later immediately. This patch is the authoritative fix for the MFA bypass vulnerability. Organizations unable to upgrade immediately should enforce strict access controls on the GLPI application by restricting network access to trusted IP ranges via firewall rules or reverse proxy configuration, implementing HTTP-only session cookies with secure flag enabled, and monitoring authentication logs for suspicious login patterns or rapid session changes that may indicate MFA bypass attempts. Additionally, conduct a credential audit to identify any accounts that may have been compromised and force password resets for sensitive administrative accounts. For ongoing protection during the patching window, consider implementing a Web Application Firewall (WAF) configured to detect anomalous authentication patterns or implementing additional out-of-band verification for administrative actions. Refer to the GitHub Security Advisory at https://github.com/glpi-project/glpi/security/advisories/GHSA-2g3p-vwp2-7qxm for detailed patch notes and deployment guidance.