GLPI Unauthorized Authentication Vulnerability via OAuthIMAP Plugin

A vulnerability exists in GLPI versions 9.5.0 through 10.0.18, allowing unauthorized authentication through an OAuth connection via the OAuthIMAP plugin. This issue arises when a 'Mail servers' authentication provider is set to use OAuth, enabling anyone to access GLPI using a username with established OAuth authorization.

Impact

Exploitation of this vulnerability allows unauthorized users to authenticate to GLPI, potentially leading to unauthorized access or actions within the application.

Remediation

Users can upgrade to GLPI version 10.0.18, which addresses this vulnerability. Alternatively, any 'Mail servers' authentication provider using an OAuth connection from the OAuthIMAP plugin can be disabled.