CVE-2026-116201: 
Snipe-IT vulnerability analysis and mitigation

CVE-2026-116201 is a SAML assertion replay vulnerability in Snipe-IT, an open-source IT asset management application developed by Grokability, Inc. The flaw allows attackers who have captured a valid SAML assertion to reuse it by exploiting a non-atomic nonce check in the SAML ACS (Assertion Consumer Service) handler, enabling the creation of multiple authenticated victim sessions that evade IdP-driven revocation. All versions of Snipe-IT up to and including 8.4.1 are affected; version 8.5.0 contains the fix. The vulnerability carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Snipe-IT Advisory). It was published on October 25, 2026, and assigned by VulnCheck (GitHub Advisory).

The root cause is a combination of two structural weaknesses classified under CWE-294 (Authentication Bypass by Capture-Replay) and CWE-367 (Time-of-Check Time-of-Use Race Condition). In app/Http/Controllers/Auth/LoginController.php, the loginViaSaml method used a check-then-insert pattern against the saml_nonces table: it first queried whether the nonce count was zero, then called Auth::login(), and finally inserted the nonce — all without wrapping the sequence in a database transaction. Compounding this, the saml_nonces.nonce column was indexed with a non-unique index (defined in database/migrations/2024_01_24_145544_create_saml_nonce_table.php) rather than a UNIQUE constraint, meaning two concurrent requests carrying the same nonce could both pass the count-zero check simultaneously and each proceed to create an authenticated session (Snipe-IT Advisory). Exploitation requires the attacker to first obtain a valid SAML assertion for the victim — via network-positioned MITM on the IdP-to-SP path, a malicious browser extension, or a log/Referer leak — and then submit it concurrently within a sub-second race window (Snipe-IT Advisory).

Successful exploitation allows an attacker to obtain multiple valid authenticated sessions for a victim user from a single captured SAML assertion, with full confidentiality, integrity, and availability impact on the vulnerable system. Because the replayed sessions are created independently, subsequent IdP-driven session revocation (e.g., forced logout or token invalidation) will only terminate one of the sessions, leaving the attacker's session active and undetected. In the context of Snipe-IT — which manages IT asset inventories, licenses, and user assignments — unauthorized access could expose sensitive organizational asset data, enable unauthorized modifications to asset records, and potentially facilitate further lateral movement within the organization's IT infrastructure (Snipe-IT Advisory, GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already possess a captured SAML assertion for the target victim and the ability to send concurrent HTTP requests, which limits opportunistic exploitation but remains feasible for targeted attacks (Snipe-IT Advisory).

1. Prerequisite — Obtain a valid SAML assertion: Position to intercept a SAML assertion for the victim user via one of the following methods: network-level MITM on the IdP-to-SP communication path, a malicious browser extension that captures POST data, or exploitation of a log or Referer header leak that exposes the assertion.
2. Identify the target endpoint: Confirm the Snipe-IT instance has SAML SSO enabled (saml_enabled = 1 with valid IdP metadata configured) and locate the ACS endpoint at POST /saml/acs.
3. Prepare concurrent requests: Set up two separate HTTP sessions (e.g., two distinct cookie jars using tools like curl, Python requests, or Burp Suite's Turbo Intruder) each ready to POST the same captured SAML assertion to /saml/acs.
4. Execute the race condition: Send both POST requests simultaneously (within a sub-second window) so that both requests pass the nonce count-zero check before either has inserted the nonce into the saml_nonces table.
5. Harvest multiple sessions: Both requests complete Auth::login() and return authenticated session cookies. The attacker now holds a valid session cookie independent of the victim's session, which persists even if the IdP revokes the victim's session (Snipe-IT Advisory).

• Network: Multiple near-simultaneous POST requests to /saml/acs from the same or different source IPs carrying an identical SAML assertion body within a sub-second window; unexpected outbound connections from the Snipe-IT server following SAML authentication events.
• Logs: Web server access logs showing two or more successful HTTP 200/302 responses to POST /saml/acs with the same SAMLResponse parameter value within milliseconds; application logs recording duplicate Auth::login() events for the same user in rapid succession.
• Database: Duplicate entries in the saml_nonces table sharing the same nonce value with nearly identical timestamps, indicating the race condition was triggered.
• Session: Multiple concurrent active sessions for the same user account originating from different IP addresses or user agents, particularly where one session persists after an IdP-initiated logout event (Snipe-IT Advisory).

Upgrade Snipe-IT to version 8.5.0 or later, which resolves the vulnerability through two changes: the application layer was switched to an insert-first-catch-on-duplicate pattern wrapping Auth::login(), and a new database migration (2026_05_05_125206_add_unique_index_to_nonces.php) adds a UNIQUE constraint to the saml_nonces.nonce column (running saml:clear_expired_nonces first to purge stale rows before applying the constraint) (Snipe-IT Advisory). As interim mitigations, administrators should implement network-level controls to restrict access to the /saml/acs endpoint, monitor for suspicious concurrent authentication attempts using the same SAML assertion, and proactively review and revoke any suspicious authenticated sessions.

The vulnerability was reported by researcher builtbybrayden and remediated by the Snipe-IT maintainer (snipe), as credited in the official GitHub Security Advisory (Snipe-IT Advisory). VulnCheck published an advisory and was the assigning CNA for the CVE (GitHub Advisory). No significant broader media coverage or notable community commentary beyond standard vulnerability tracking aggregators has been observed at this time.