CVE-2026-63493

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0.

• CWE-288

• https://github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e
• https://github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780
• https://github.com/grokability/snipe-it/pull/19294
• https://github.com/grokability/snipe-it/releases/tag/v8.7.0
• https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6347Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…7.6
• CVE-2026-63472Vendure is an open-source headless commerce platform. Prior …9.1
• CVE-2026-6348WinMatrix agent developed by Simopro Technology has a Missin…9.3
• CVE-2026-63481Hurl is a command line tool that runs and tests HTTP request…6.9
• CVE-2026-6349The  iSherlock developed by HGiga  has an OS Command Injecti…9.8
• CVE-2026-63490Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-63495Libevent is an event notification library. From 2.2.0-alpha-…7.5
• CVE-2026-63498Snipe-IT is an IT asset/license management system. Prior to …8.7
• CVE-2026-6350MailGates/MailAudit developed by Openfind has a Stack-based …9.8
• CVE-2026-63506Tina is a headless content management system. Prior to @tina…8.8
• CVE-2026-63508Missing authentication for critical function in Microsoft Pl…10
• CVE-2026-63509Relative path traversal in Microsoft Fabric allows an author…8.8