CVE-2026-116199EUVD-2026-109457
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 8.6.3
- Public exploit
- None on Exploit-DB
Summary
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.
Affected versions
- grokability snipe-it
fixed in 8.6.3