UpHeron
All vulnerabilities

Servers and applications

CVE-2026-116201

Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Severity
High 8.7
Published
25 Oct 2026
Last changed
29 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
8.5.0
Sources
NVD, CVE Program

Description

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.

Affected software

SoftwareAffected versions
Snipe-ITServers and applications · cna:grokability|snipe-it
  • Every version before 8.5.0
Snipe-ITServers and applications · cpe:a:snipeitapp:snipe-it
  • Every version before 8.5.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-116201
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-116201