Executive brief
Snipe-IT, an open-source asset management system, contains a flaw in its two-factor authentication (2FA) process. An attacker who already knows a user's password can repeatedly guess the secondary security code without being locked out. If successful, the attacker can gain full access to the account and, in some configurations, permanently disable the security feature for that user.
Technical details
The `POST /two-factor` endpoint in Snipe-IT lacks rate limiting, lockout mechanisms, or attempt counters. This allows an attacker with valid primary credentials to perform a brute-force attack against the 6-digit TOTP code. Because the implementation accepts the current code plus one step on either side (a window of 3 valid codes out of 1,000,000), the probability of a successful guess is increased. Upon successful exploitation, the attacker gains a fully authenticated session. If 2FA is set to optional mode, the attacker can further disable 2FA via the profile settings without re-verification. Administrative accounts can also be targeted to reset other users' 2FA secrets via the API. This issue is resolved in version 8.6.0.
Affected products
- grokability Snipe-IT < 8.6.0
Timeline
- 2026-06-08: disclosed
- 2026-06-23: advisory
- 2026-06-23: patched: Patched in v8.6.0