CVE-2025-23046 GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin

Medium 6.3 Published 25 Feb 2025 Updated 25 Feb 2025

Attackers can bypass authentication and access GLPI accounts if the OauthIMAP plugin is configured for mail server authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-23046?

CVE-2025-23046 is a medium-severity authentication bypass vulnerability in Glpi-Project Glpi, published on 25 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.

Weakness: CWE-303

Which versions are affected by CVE-2025-23046?

It affects 1 product.

Products include Glpi-Project Glpi.

How do I fix CVE-2025-23046?

No fix has been published for CVE-2025-23046 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-23046 being exploited?

There is no known exploitation of CVE-2025-23046 in the wild and no public exploit code.

All Glpi-Project Glpi vulnerabilities

Sources

Also known as GHSA-vfxc-qg3v-j2r5, UBUNTU-CVE-2025-23046.