CVE-2026-86754: Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients
Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Snipe-IT user can register OAuth clients because the affected OAuth client management routes are not properly restricted. Exploitation also requires convincing an administrator to approve an OAuth consent screen.
What access does a successful attacker obtain?
After an administrator approves consent, the attacker can exchange the authorization code for a bearer token with full administrator API permissions. The token can remain valid for up to 40 years.
Are unauthenticated attackers affected?
No. The described attack requires an existing authenticated user account in Snipe-IT, followed by administrator interaction with a consent screen.
What versions should be treated as vulnerable?
Snipe-IT versions before 8.7.0 are affected. Upgrading to 8.7.0 or later addresses the version range identified in the advisory.