CVE-2026-49470

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

PT-2026-99068

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description The time-based one-time password TOTP verification endpoint does not limit failed submissions per user. An attacker with a user's primary authentication credentials can repeatedly submit TOTP...