CVE-2026-86756

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86756

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86756.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86756

Aliases

GHSA-68hq-m589-8q9j

Published

2026-09-09T13:32:17Z

Modified

2026-09-11T03:48:43Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Details

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and LoginController later issued redirect()->intended(), which passes an absolute URL through to the Location header unchanged. An unauthenticated attacker who induces a user of a SAML-SSO-enabled instance to visit a crafted IdP-initiated SSO link can therefore cause the victim's browser to be redirected to an arbitrary absolute external URL immediately after a successful authentication, which the advisory notes facilitates credential-harvesting phishing. No account on the target instance and no compromise of the identity provider are required. Only deployments with SAML SSO enabled are affected. Fixed in 8.7.0 (commit d30b73d, PR #19386), which validates RelayState via a new Helper::sameOriginUrl check before storing it.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86756.json"
}

References

Affected packages

Git / github.com/grokability/snipe-it

Affected ranges

Type

GIT

Repo

https://github.com/grokability/snipe-it

Events

Introduced

90c86895965db59ce7d843429ea537716bee8b0f

Fixed

cfd1ff8413e478a8daab700c15e96c96f93220e2

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "8.5.0"
        },
        {
            "last_affected": "8.7.2"
        },
        {
            "fixed": "8.6.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v8.*

v8.5.0

v8.6.0

v8.6.1

v8.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86756.json"