CVE-2026-86756

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and LoginController later issued redirect()->intended(), which passes an absolute URL through to the Location header unchanged. An unauthenticated attacker who induces a user of a SAML-SSO-enabled instance to visit a crafted IdP-initiated SSO link can therefore cause the victim's browser to be redirected to an arbitrary absolute external URL immediately after a successful authentication, which the advisory notes facilitates credential-harvesting phishing. No account on the target instance and no compromise of the identity provider are required. Only deployments with SAML SSO enabled are affected. Fixed in 8.7.0 (commit d30b73d, PR #19386), which validates RelayState via a new Helper::sameOriginUrl check before storing it.

• CWE-601

• https://github.com/grokability/snipe-it/security/advisories/GHSA-68hq-m589-8q9jExploit, Vendor Advisory
• https://www.vulncheck.com/advisories/snipe-it-8.5.0-through-8.6.3-open-redirect-via-saml-relaystateThird Party Advisory

Published

Sep 9, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86750Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate …7.7
• CVE-2026-86751Snipe-IT before 8.7.0 fails to properly sanitize markdown im…9.6
• CVE-2026-86752snipe-it versions before 8.7.0 fail to enforce per-instance …5.4
• CVE-2026-86753snipe-it versions before 8.7.0 fail to validate the requesta…4.3
• CVE-2026-86754Snipe-IT before 8.7.0 fails to properly gate Laravel Passpor…7.3
• CVE-2026-86755Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passpor…5.4
• CVE-2026-86757Snipe-IT before 8.7.0 fails to properly gate access to encry…6.5
• CVE-2026-86758Snipe-IT before 8.7.0 fails to properly enforce the viewKeys…6.5
• CVE-2026-86759Snipe-IT versions before 8.7.0 fail to authorize the POST /h…7.1
• CVE-2026-8676An attacker is able to downgrade the security of a Bluetooth…8.8
• CVE-2026-86760Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) conta…5.4
• CVE-2026-86761snipe-it versions before 8.7.0 contain an authorization bypa…4.3