Snipe-IT: Authentication bypass via Google SSO callback
Summary
Snipe-IT before 8.6.3 does not check the activated flag when a user signs in via Google SSO. A deactivated user whose username matches their Google account email, and whose Google identity is still active, can log in and regain a session with their original permissions, including admin rights. The attack requires Google SSO to be enabled and a matching account to exist.
Affected
- Snipe-IT up to and including 8.6.2 (affected: before 8.6.3)
- Affected component: GoogleAuthController::handleGoogleCallback
Fixed in
- Snipe-IT 8.6.3 and later (fix in commit 5fea2fadc0)
Workaround
- Disable Google SSO if it is not required.
- Suspend or delete the Google Workspace accounts of deactivated users, or remove their Snipe-IT accounts.
- Unknown: no other vendor workaround has been confirmed.
Exploitation
- No public exploit code has been confirmed at the time of writing.
- Not listed as known exploited (CISA KEV).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade Snipe-IT to version 8.6.3 or later.
- If Google SSO is enabled, check for deactivated accounts with email-style usernames and confirm that their Google accounts are suspended.
- Review login logs since 25 October 2026 for Google SSO logins by deactivated users.
- Check the vendor advisory GHSA-gq7g-hxjg-8j27 for any further fix that may be needed after 8.6.3.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xf36-wx48-5rqp github.com
- VulnCheck advisory: Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback www.vulncheck.com
- VulDB CVE-2026-116199 vuldb.com
- GitHub Security Advisory GHSA-gq7g-hxjg-8j27 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:02.
Original description (NVD)
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.