# CVE-2026-49870: Snipe-IT TOTP brute force due to missing rate limiting in /two-factor

Source: https://junglewise.ai/threats/cve-2026-49870-snipe-it-totp-brute-force-due-to-missing-rate-limiting-in-two  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-49870 · Severity: medium · CVSS 5.9 · Published 2026-08-19

Snipe-IT, an open-source asset management system, contains a flaw in its two-factor authentication (2FA) process. An attacker who already knows a user's password can repeatedly guess the secondary security code without being locked out. If successful, the attacker can gain full access to the account and, in some configurations, permanently disable the security feature for that user.

Technologies: [snipe/snipe-it (Packagist)](https://junglewise.ai/threats/technologies/snipe-snipe-it), [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-49870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49870 being exploited in the wild.

**How severe is CVE-2026-49870?** Medium severity, with a CVSS score of 5.9, published 19 August 2026.

**Which products and versions are affected?** snipe/snipe-it (Packagist) < 8.6.0, ECOSYSTEM:introduced=0,fixed=8.6.0.

**Is there a fix for CVE-2026-49870?** Yes. snipe/snipe-it (Packagist): upgrade to 8.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49870 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49870?** Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- snipe/snipe-it (Packagist): upgrade to 8.6.0 or later

  ```sh
  composer require snipe/snipe-it:^8.6.0
  ```


## Technical details

The `POST /two-factor` endpoint in Snipe-IT lacks rate limiting, lockout mechanisms, or attempt counters. This allows an attacker with valid primary credentials to perform a brute-force attack against the 6-digit TOTP code. Because the implementation accepts the current code plus one step on either side (a window of 3 valid codes out of 1,000,000), the probability of a successful guess is increased. Upon successful exploitation, the attacker gains a fully authenticated session. If 2FA is set to optional mode, the attacker can further disable 2FA via the profile settings without re-verification. Administrative accounts can also be targeted to reset other users' 2FA secrets via the API. This issue is resolved in version 8.6.0.

## Affected products

- grokability Snipe-IT < 8.6.0

## Identifiers

- CVE-2026-49870
- GHSA-mr8g-2mj4-pcq2

## Timeline

- 2026-06-08: disclosed
- 2026-06-23: advisory
- 2026-06-23: patched: Patched in v8.6.0

## References

- [https://api.github.com/users/SakusenSec](https://api.github.com/users/SakusenSec)
- [https://github.com/SakusenSec](https://github.com/SakusenSec)
- [https://api.github.com/users/SakusenSec/gists%7B/gist_id%7D](https://api.github.com/users/SakusenSec/gists%7B/gist_id%7D)
- [https://api.github.com/users/SakusenSec/repos](https://api.github.com/users/SakusenSec/repos)
- [https://avatars.githubusercontent.com/u/268783706?v=4](https://avatars.githubusercontent.com/u/268783706?v=4)
- [https://api.github.com/users/SakusenSec/events%7B/privacy%7D](https://api.github.com/users/SakusenSec/events%7B/privacy%7D)

## Related threats

- [Snipe-IT stored XSS via inline XML rendering in uploaded files API](https://junglewise.ai/threats/cve-2026-63498-snipe-it-stored-xss-via-inline-xml-rendering-in-uploaded-files)
- [Snipe-IT 2FA bypass via API token flow](https://junglewise.ai/threats/cve-2026-63493-snipe-it-2fa-bypass-via-api-token-flow)
- [Snipe-IT stored XSS in custom field names](https://junglewise.ai/threats/cve-2026-62368-snipe-it-stored-xss-in-custom-field-names)
- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)