CVE-2025-23046
📋 TL;DR
This vulnerability allows authentication bypass in GLPI when using OauthIMAP plugin with Mail servers authentication. Anyone can connect using any username that already has Oauth authorization established. Affects GLPI installations with OauthIMAP plugin configured for Mail servers authentication.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain access to GLPI with privileges of any user who has previously authorized Oauth, potentially leading to data theft, privilege escalation, or system compromise.
Likely Case
Attackers access GLPI with user accounts they shouldn't have access to, potentially viewing sensitive IT asset data or performing unauthorized actions.
If Mitigated
With proper access controls and monitoring, impact limited to unauthorized access detection and containment.
🎯 Exploit Status
Requires knowledge of existing Oauth authorizations and targeted user accounts
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.18
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-vfxc-qg3v-j2r5
Restart Required: No
Instructions:
1. Backup GLPI installation and database. 2. Download GLPI 10.0.18 from official repository. 3. Replace existing files with new version. 4. Run database update if prompted.
🔧 Temporary Workarounds
Disable OauthIMAP Mail servers authentication
allDisable any Mail servers authentication provider configured to use Oauth connection from OauthIMAP plugin
Navigate to GLPI Setup > Authentication > Mail servers and disable affected providers
🧯 If You Can't Patch
- Disable OauthIMAP plugin entirely
- Implement network segmentation to restrict GLPI access
🔍 How to Verify
Check if Vulnerable:
Check GLPI version and verify if OauthIMAP plugin is configured for Mail servers authenticationCheck Version:
Check GLPI About page or database glpi_config table for versionVerify Fix Applied:
Confirm GLPI version is 10.0.18 or later, verify OauthIMAP authentication works correctly📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns from unexpected IPs
- Multiple failed login attempts followed by successful Oauth logins
Network Indicators:
- Authentication requests to Oauth endpoints without corresponding user actions
SIEM Query:
source="glpi" (event_type="authentication" AND auth_method="oauth" AND result="success") | stats count by user, src_ip