A flaw in GLPI’s time‑based one‑time password (TOTP) verification endpoint allows unlimited attempts per user. If an attacker has already stolen a legitimate user’s primary credentials, they can try thousands of TOTP values in rapid succession, eventually guessing the correct token and gaining full access to the account. This bypasses the intended second factor of authentication and results in a full account takeover. The weakness is a login failure due to missing input validation tied to authentication, corresponding to CWE‑307.

The vulnerability affects GLPI software from version 11.0.0 up to and including 11.0.8. All installations of the glpi-project GLPI product that have not applied the patch in release 11.0.8 remain vulnerable. The affected vendor is glpi‑project and the product name is GLPI.

The CVSS score of 7.7 classifies the weakness as high severity. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the fact that only an attacker with valid first‑factor credentials can exploit the flaw limits the potential attack surface. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is a brute‑force attack on the TOTP endpoint after the attacker has already compromised or guessed the primary user credentials, as explicitly stated in the description.