Live › vulnerability › CVE-2026-116201
Go to dashboardSnipe-IT before 8.5.0 has a race in its SAML assertion handler: the nonce check is not atomic, so a captured assertion can be replayed with concurrent POSTs to /saml/acs. An attacker can obtain several authenticated victim sessions that survive IdP-driven revocation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running self-hosted Snipe-IT before 8.5.0 with SAML single sign-on enabled are exposed, since the replay happens at the SAML acs endpoint. Instances that use only local accounts or do not enable SAML can skip it.
No product ranges from the sources yet.
php artisan --version or the version shown in the admin footer; anything below 8.5.0 is affected.8.5.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.
This page as .md · .json · in your agent: get_signal("CVE-2026-116201")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.