CVE-2026-86770
Last modified
CVE-2026-86770 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Snipeitapp | Snipe-It | < 8.7.0 |
References
- https://github.com/grokability/snipe-it/security/advisories/GHSA-w3vv-5wxh-xg4hExploit, Vendor Advisory
- https://github.com/grokability/snipe-it/security/advisories/GHSA-w3vv-5wxh-xg4hExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-86770?
How severe is CVE-2026-86770?
How do I fix CVE-2026-86770?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-86765Snipe-IT versions before 8.7.0 fail to enforce checkout auth…6.5
- CVE-2026-86766Snipe-IT versions up to and including 8.6.3 contain a race c…6.5
- CVE-2026-86767Snipe-IT versions before 8.7.0 fail to apply company scope f…5
- CVE-2026-86768Snipe-IT before 8.7.0 fails to validate soft-deleted state i…5.4
- CVE-2026-86769Snipe-IT versions before 8.7.0 contain an improper ownership…4.3
- CVE-2026-8677The Prime Elementor Addons – Lightweight Elementor Widgets f…6.4
- CVE-2026-86771Snipe-IT versions before 8.7.0 fail to HTML-escape the emplo…7.6
- CVE-2026-86772Snipe-IT versions before 8.7.0 contain a stored cross-site s…5.4
- CVE-2026-86773Snipe-IT through version 8.6.3 fails to perform object-level…5.4
- CVE-2026-86774Snipe-IT versions before 8.7.0 contain a broken access contr…6.3
- CVE-2026-86775knowns (npm package) versions <= 0.29.1 contain a path trave…8.6
- CVE-2026-86776KeePass versions 2.35 through 2.61.1 fail to validate KDBX h…3.3
Are you affected by CVE-2026-86770?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST