CVE-2025-23046 — GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use…
Published: 2025-02-25 · CVSS: 6.3 · CVSS 4.0
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7