CVE-2026-23624
📋 TL;DR
This vulnerability in GLPI allows session hijacking when remote authentication via SSO is used. An attacker on the same machine can steal another user's active GLPI session. This affects GLPI installations using SSO-based remote authentication.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains unauthorized access to another user's GLPI session, potentially accessing sensitive IT asset data, performing unauthorized actions, or escalating privileges within the GLPI system.
Likely Case
Session theft leading to unauthorized access to GLPI data and functionality under the victim's permissions, potentially including asset management data and IT service information.
If Mitigated
Limited impact if proper session management controls, network segmentation, and access controls are in place to prevent unauthorized machine access.
🎯 Exploit Status
Exploitation requires access to the same machine as the victim and SSO-based authentication to be enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.23 or 11.0.5
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download GLPI 10.0.23 or 11.0.5 from the official releases. 3. Replace existing files with the patched version. 4. Run the update script if upgrading between major versions.
🔧 Temporary Workarounds
Disable SSO Remote Authentication
allTemporarily disable SSO-based remote authentication until patching is complete
Edit GLPI configuration to disable remote authentication via SSO
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from accessing machines with active GLPI sessions
- Enable session timeout policies and force regular re-authentication for GLPI users
🔍 How to Verify
Check if Vulnerable:
Check if GLPI version is between 0.71-10.0.22 or 11.0.0-11.0.4 and SSO remote authentication is enabledCheck Version:
Check GLPI version in the web interface footer or via 'php glpi/version.php'Verify Fix Applied:
Verify GLPI version is 10.0.23 or higher, or 11.0.5 or higher📡 Detection & Monitoring
Log Indicators:
- Multiple sessions from same IP with different user accounts
- Unusual session activity patterns
Network Indicators:
- Multiple authentication requests from same source in short timeframe
SIEM Query:
source="glpi" AND (event="session_start" OR event="authentication") | stats count by src_ip, user