{"id":"CVE-2026-116201","kind":"vulnerability","aliases":["CVE-2026-116201"],"related":[],"title":"Snipe-IT: concurrent SAML assertion replay yields multiple victim sessions","description":"Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.","summary":"Snipe-IT before 8.5.0 has a race in its SAML assertion handler: the nonce check is not atomic, so a captured assertion can be replayed with concurrent POSTs to /saml/acs. An attacker can obtain several authenticated victim sessions that survive IdP-driven revocation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","saml","self-hosted","snipe-it"],"not_affected_if":["default-config","local-auth-only"],"how_to_check":"- Check the installed Snipe-IT version, for example with `php artisan --version` or the version shown in the admin footer; anything below `8.5.0` is affected.\n- Confirm SAML single sign-on is enabled in the Snipe-IT SAML settings; without SAML the flaw does not apply.","fix":"- Upgrade Snipe-IT to `8.5.0` or later.\n- Until upgraded, consider disabling SAML login or rotating active sessions after revoking users at the identity provider.","status":"open","published_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:12+00:00","updated_at":"2026-10-25T14:42:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Snipe-IT to `8.5.0` or later.\n- Until upgraded, consider disabling SAML login or rotating active sessions after revoking users at the identity provider.","reach":"internet","title":"Snipe-IT: concurrent SAML assertion replay yields multiple victim sessions","impact":"high","summary":"Snipe-IT before 8.5.0 has a race in its SAML assertion handler: the nonce check is not atomic, so a captured assertion can be replayed with concurrent POSTs to /saml/acs. An attacker can obtain several authenticated victim sessions that survive IdP-driven revocation.","category":"package","nicknames":[],"who_cares":["snipe-it","self-hosted","saml","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gets multiple authenticated victim sessions that survive IdP revocation","analyst_note":"Confirm the fixed version and whether 8.5.0 is the actual patched release via the Snipe-IT release notes or the NVD entry; sources give no fix or check details.","how_to_check":"- Check the installed Snipe-IT version, for example with `php artisan --version` or the version shown in the admin footer; anything below `8.5.0` is affected.\n- Confirm SAML single sign-on is enabled in the Snipe-IT SAML settings; without SAML the flaw does not apply.","needs_analyst":true,"not_affected_if":["default-config","local-auth-only"],"who_is_affected":"Teams running self-hosted Snipe-IT before 8.5.0 with SAML single sign-on enabled are exposed, since the replay happens at the SAML acs endpoint. Instances that use only local accounts or do not enable SAML can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":3351,"output_tokens":644,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116201':14A,17A '-2026':13A,16A '/saml/acs':56B,109C '8.5.0':30B,75C 'ac':100C 'allow':83C 'assert':6A,37B,48B,79C,88C,113C 'atom':44B,94C 'attack':58B,84C,102C 'authent':62B,117C 'captur':47B,87C,112C 'check':41B,96C 'concurr':4A,53B,105C 'contain':76C 'cve':12A,15A 'driven':69B,124C 'evad':121C 'exploit':90C 'handler':38B,101C 'host':23B 'idp':68B,123C 'idp-driven':67B,122C 'multipl':9A,116C 'non':93C 'non-atom':92C 'nonc':40B,95C 'obtain':60B,115C 'one':111C 'packag':18B 'php':19B 'post':54B,106C 'race':33B 'replay':7A,51B,80C 'request':107C 'reus':86C 'revoc':70B,125C 'saml':5A,20B,36B,78C,99C 'self':22B 'self-host':21B 'send':104C 'session':11A,64B,119C 'sever':61B 'snipe':2A,25B,27B,72C 'snipe-it':1A,24B,26B,71C 'surviv':66B 'victim':10A,63B,118C 'vulner':81C 'yield':8A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Snipe-IT before 8.5.0 with SAML single sign-on enabled are exposed, since the replay happens at the SAML acs endpoint. Instances that use only local accounts or do not enable SAML can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116201","severity":null,"published_at":"2026-10-25T14:17:00+00:00","modified_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}