CVE-2026-86756: Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and LoginController later issued redirect()->intended(), which passes an absolute URL through to the Location header unchanged. An unauthenticated attacker who induces a user of a SAML-SSO-enabled instance to visit a crafted IdP-initiated SSO link can therefore cause the victim's browser to be redirected to an arbitrary absolute external URL immediately after a successful authentication, which the advisory notes facilitates credential-harvesting phishing. No account on the target instance and no compromise of the identity provider are required. Only deployments with SAML SSO enabled are affected. Fixed in 8.7.0 (commit d30b73d, PR #19386), which validates RelayState via a new Helper::sameOriginUrl check before storing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0Patch d30b73d - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PR #19386
Event History
Frequently Asked Questions
Which deployments are affected?
Only Snipe-IT deployments with SAML SSO enabled are affected. The issue applies to versions 8.5.0 through 8.6.3.
What must an attacker do to exploit this issue?
An attacker must induce a user of an affected instance to visit a crafted IdP-initiated SSO link. No account on the Snipe-IT instance and no compromise of the identity provider are required.
What is the practical impact on users?
After the user successfully authenticates through SAML, their browser can be redirected to an arbitrary external URL. The advisory notes that this can facilitate credential-harvesting phishing.
How can the issue be remediated?
Upgrade to Snipe-IT 8.7.0. The fix validates RelayState with a same-origin URL check before it is stored for the post-login redirect.