Snipe-IT: SAML assertion replay via race condition
Summary
Snipe-IT before 8.5.0 allows an attacker who has captured a valid SAML assertion to replay it. Because the nonce check and insert are not atomic, two concurrent requests to /saml/acs can both succeed and create multiple authenticated sessions for the same user. Sessions created this way can evade IdP-driven session revocation for some of them.
Affected
- Snipe-IT up to and including 8.4.1 (CNA record: before 8.5.0)
- Only instances with SAML SSO enabled and valid IdP metadata
Fixed in
- Snipe-IT 8.5.0 and later (fix in commit 5b0a779c07)
Workaround
- No vendor workaround listed.
- If SAML is not required, disable SAML SSO until 8.5.0 is deployed (test first, as this changes the login path).
- Restrict access to the instance where possible.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- No public proof of concept found in the sources.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Attacker needs a captured valid SAML assertion (e.g. via MITM, malicious browser extension, or log/Referer leak).
Our recommendation
- Identify all Snipe-IT instances and their versions; flag any below 8.5.0.
- Upgrade to Snipe-IT 8.5.0 or later.
- Until upgraded, disable SAML SSO if not essential and restrict access to the instance.
- Review IdP session-revocation practice for this application and check active sessions after the upgrade.
- Prioritise according to the CVSS 4.0 score of 8.7 (the GitHub advisory label is Moderate).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-w49g-f2jc-qxhg github.com
- VulnCheck advisory: Snipe-IT before 8.5.0 SAML Assertion Replay www.vulncheck.com
- OpenCVE CVE-2026-116201 app.opencve.io
- PSIRT CVE-2026-116201 psirt.com
- VulDB entry 426264 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:15.
Original description (NVD)
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.