CVE-2026-86770: Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Snipe-IT deployments before 8.7.0 that use federated authentication paths are exposed, including SAML, LDAP, and OAuth. The described bypass relies on the default utf8mb4_unicode_ci database collation.
What does an attacker need to exploit it?
An attacker needs an identity-provider account whose username is an accent or case variant of a victim's username. They also need access to a federated login path accepted by the affected Snipe-IT deployment.
What is the likely impact of successful exploitation?
Successful exploitation allows authentication as a different user and can result in account takeover. The affected matching behavior can cause the variant username to be treated as the victim's username.