GLPI CVE-2026-49470

Requires that the attacker has ALREADY obtained the target user's valid primary username and password (PR:L) and that TOTP-based multi-factor authentication is enabled on that account - only then does the unthrottled TOTP verification endpoint (GLPI 11.0.0 through 11.0.7) become the exploitable brute-force surface. Exploitation is limited by the need for prior credential compromise and by the practical difficulty of guessing a rotating time-based code within its short validity window; it is remote and needs no user interaction (UI:N), but does not work against default configurations lacking MFA or against patched instances (11.0.8) which now rate-limit failed submissions via symfony/rate-limiter.

The official CVSS 4.0 vector (7.7, AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: network-reachable MFA endpoint (AV:N), requires already-obtained primary credentials (PR:L), no user interaction, and full compromise of the account on success (VC:H/VI:H/VA:H). AC:H is justified because the attacker must already hold valid primary credentials AND grind through the TOTP keyspace (a 6-digit TOTP is ~1,000,000 combinations, further constrained by the ~30s time window), so success is probabilistic rather than deterministic. No EPSS score, KEV listing, or public POC is provided in the input - there is no public exploit identified at time of analysis, and no evidence of active exploitation. The fix commit is confirmed (adds symfony/rate-limiter dependency), so the root cause and remediation are well established. Net: this is a genuine second-factor-defeat/account-takeover issue but its exploitation is gated by prior credential compromise and the practical difficulty of brute-forcing a rotating TOTP within its validity window - a real, prioritizable defense-in-depth failure rather than a mass-exploitable pre-auth flaw.

An attacker who has already phished or credential-stuffed a GLPI user's username and password reaches the MFA verification step and, because failed TOTP submissions are not rate-limited or locked out, scripts repeated guesses against the verification endpoint until a valid code lands within its time window, completing login as that user. No public exploit code is identified in the provided data. The network attack vector (AV:N) makes this automatable, but AC:H reflects the need for valid primary credentials plus the statistical grind against a rotating code.