CVE-2026-63493: 
PHP 취약성 분석 및 완화

CVE-2026-63493 is a two-factor authentication (2FA) bypass vulnerability in Snipe-IT, an open-source IT asset and license management system. An attacker who possesses a victim's password can bypass the account's 2FA requirement by exploiting a middleware enforcement gap, obtaining a persistent API token with full API access without ever completing the second-factor challenge. All versions up to and including 8.6.3 are affected; the vulnerability is fixed in version 8.7.0. It carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Feedly).

The root cause is an authentication bypass via an alternate path or channel (CWE-288): Snipe-IT's CheckForTwoFactor middleware is registered only in the web middleware group, not the api middleware group. After a successful password-only login, the session is redirected to /two-factor — a route explicitly exempted from the 2FA check — which causes Laravel Passport's CreateFreshApiToken middleware to issue a snipeit_passport_token cookie. The attacker can then POST to /api/v1/account/personal-access-tokens (gated only by the self.api permission, with no 2FA check) to mint a long-lived bearer token (40-year default expiry). This token grants full REST API access as the victim while the browser session remains blocked at the 2FA page (GitHub Advisory, Fix PR).

Successful exploitation allows an attacker with knowledge of a victim's password to read and modify all resources accessible to that account via the REST API, bypassing 2FA entirely. If the victim is an administrator, the attacker can additionally call the users/two_factor_reset endpoint to clear the admin's enrolled second factor, re-enroll an attacker-controlled TOTP device, take over the web account, and permanently lock out the legitimate user. This effectively results in full account takeover, unauthorized access to the entire IT asset inventory, and potential for privilege escalation across the Snipe-IT instance (GitHub Advisory).

A detailed proof-of-concept exploit using standard command-line tools (curl, jq) is publicly documented in the official GitHub Security Advisory, making exploitation straightforward for any attacker with a victim's password. The attack requires low privileges (a valid password) and no user interaction, and is executable over the network. As of the advisory publication date, there is no evidence of active in-the-wild exploitation, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Obtain victim credentials: Acquire the target account's password through phishing, credential stuffing, or other means. The account must have the self.api permission enabled (standard for any API-enabled account).
2. Retrieve CSRF token and authenticate: Send a GET request to $HOST/login to extract the _token CSRF value from the HTML, then POST credentials (_token, username, password) to $HOST/login. The session is now password-authenticated but blocked at the 2FA page.
3. Trigger Passport cookie issuance: Send a GET request to $HOST/two-factor without submitting a TOTP code. Because /two-factor is in the IGNORE_ROUTES list of CheckForTwoFactor, the CreateFreshApiToken middleware runs and issues the snipeit_passport_token cookie.
4. Mint a persistent API token: Extract the XSRF-TOKEN cookie value, URL-decode it, and POST to $HOST/api/v1/account/personal-access-tokens with the header X-XSRF-TOKEN: <decoded_value> and body name=poc. The response contains a bearer token with no 2FA verification performed.
5. Access the API as the victim: Use the bearer token (Authorization: Bearer <token>) against any API endpoint (e.g., GET /api/v1/users/me). If the victim is an admin, call POST /api/v1/users/{id}/two_factor_reset to clear their enrolled 2FA, then re-enroll an attacker-controlled TOTP device to take over the web account (GitHub Advisory).

• Network: Unexpected POST requests to /api/v1/account/personal-access-tokens from sessions that have not completed 2FA (i.e., sessions that recently accessed /two-factor without a subsequent successful 2FA event); API requests using bearer tokens from IP addresses not associated with the legitimate user.
• Logs: Web access logs showing a sequence of: POST /login → GET /two-factor (no code submission) → POST /api/v1/account/personal-access-tokens within a short time window; API access log entries for GET /api/v1/users/me or POST /api/v1/users/{id}/two_factor_reset using bearer tokens outside normal business hours or from unusual IPs.
• Application Events: Snipe-IT action log entries showing a user's 2FA enrollment being reset (two_factor_reset) followed by a new 2FA enrollment from an unfamiliar device; new personal access tokens created for accounts that are simultaneously blocked at the 2FA challenge page.
• File System: Presence of cookies.txt or similar files on attacker-controlled systems containing snipeit_passport_token values (relevant for forensic analysis of attacker infrastructure) (GitHub Advisory).

Upgrade Snipe-IT to version 8.7.0 or later, which introduces a new EnforceApiTwoFactorEnrollment middleware added to the api middleware group immediately after auth:api. This middleware blocks API requests from token owners who have not completed 2FA enrollment, closing the bypass (GitHub Release, Fix Commit). If immediate patching is not possible, restrict network access to the Snipe-IT application to trusted networks only, and audit existing personal access tokens for any that may have been minted without completed 2FA. Administrators should also review the users/two_factor_reset endpoint access logs for unauthorized calls (GitHub Advisory).

The vulnerability was responsibly disclosed by researchers identified as colinthebomb1, Theebanbabu, and a follow-up confirmation from SRT at Submersion (SRT@submersion.ai), and was acknowledged by the Snipe-IT maintainer (snipe) in the official GitHub Security Advisory. The fix was merged via PR #19294 on July 11, 2026, and shipped as part of the large v8.7.0 release on August 11, 2026, which included 44 security fixes in total (GitHub Advisory, GitHub Release).