CVE-2026-116201: Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Snipe-IT versions before 8.5.0 are affected when they use the SAML ACS endpoint at /saml/acs. Deployments not using SAML authentication are not identified as exposed by the available information.
What must an attacker obtain to exploit it?
The attacker needs a captured SAML assertion and must submit concurrent POST requests containing that assertion to /saml/acs. The vulnerability arises because the nonce check in the SAML ACS handler is non-atomic.
What is the practical impact of successful exploitation?
A single captured assertion can be replayed concurrently to create multiple authenticated sessions for the victim. Those sessions can evade IdP-driven revocation.
What version resolves the issue?
Upgrade Snipe-IT to version 8.5.0 or later. The issue affects versions before 8.5.0.