CVE-2026-44833: Snipe-IT: Open redirect vulnerability
Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.
Impact
- Phishing: Redirect users to fake login pages to steal credentials - Session Hijacking: Redirect to attacker site that captures session cookies via JavaScript - Malware Distribution: Redirect to sites hosting malware or drive-by downloads - Reputation Damage: Users lose trust when redirected to malicious sites from legitimate application - Social Engineering: Use trusted Snipe-IT domain to increase phishing success rate
When the user clicks "Save", the application: 1. Processes the form 2. Checks redirectoption (if set to 'back') 3. Calls Helper::getRedirectOption() 4. Retrieves backurl from session: https://evil.com/phishing?target=snipeit 5. Executes redirect()->to($backUrl) 6. User is redirected to attacker's site
This would still require session poisoning, so the actual practical threat here is minimal.
Patches Patched in https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373, released in 8.4.1.
Workarounds None.
Resources - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') - OWASP: Unvalidated Redirects and Forwards - Laravel Security: Safe Redirects
snipeitopenredirectsubmission.md
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.4.1 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.4.1Patch e37649212861a337e68a624e589c3540b7a82373 - Compensating control
Because exploitation involves session poisoning and leveraging an unvalidated HTTP Referer stored in a session variable, ensure attacker-controlled sessions cannot be established (e.g., prevent session fixation/poisoning) to reduce the practical likelihood of redirecting users to malicious sites.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44833?
CVE-2026-44833 is categorized as a high-severity open redirect vulnerability that can lead to phishing attacks and session hijacking.
How do I fix CVE-2026-44833?
To fix CVE-2026-44833, upgrade to Snipe-IT version 8.4.1 or later.
What systems are affected by CVE-2026-44833?
CVE-2026-44833 affects all versions of Snipe-IT prior to 8.4.1.
What are the potential impacts of CVE-2026-44833?
If exploited, CVE-2026-44833 can enable attackers to redirect users to malicious sites for phishing or hijacking sessions.
How does CVE-2026-44833 work?
CVE-2026-44833 allows attackers to manipulate the HTTP Referer header stored in a session variable to redirect users to untrusted websites.