CVE-2021-39210: Autologin cookie accessible by scripts

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-15 · updated 2026-06-17
Weakness: CWE-1004

Description

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue is fixed in version 9.5.6. As a workaround, one may avoid using the "remember me" feature.

Affected products

glpi-project glpi: before 9.5.6 — fixed in 9.5.6

How to fix

Upgrade to a fixed version: glpi-project glpi 9.5.6. Check the vendor advisory for mitigations.

References

https://github.com/glpi-project/glpi/releases/tag/9.5.6
https://github.com/glpi-project/glpi/security/advisories/GHSA-hwxq-4c5f-m4v2
https://huntr.dev/bounties/b2e99a41-b904-419f-a274-ae383e4925f2/
https://github.com/glpi-project/glpi/releases/tag/9.5.6
https://github.com/glpi-project/glpi/security/advisories/GHSA-hwxq-4c5f-m4v2
https://huntr.dev/bounties/b2e99a41-b904-419f-a274-ae383e4925f2/

Get alerted when CVE-2021-39210 or the next vulnerability affects your stack