Executive brief
Snipe-IT is an asset management system used by organizations to track equipment and inventory. Versions 8.5.0 through 8.6.3 contain an open redirect flaw in the SAML single sign-on feature that allows an attacker to redirect authenticated users to a malicious external website immediately after they log in—a technique commonly used for credential-harvesting phishing attacks. The vulnerability requires no account access and affects only deployments with SAML SSO enabled.
Technical details
The vulnerability is an open redirect (CWE-601) in the SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The vulnerable code accepts the RelayState POST parameter from the SAML response and writes it directly into Laravel's url.intended session key after stripping only CR/LF characters, without validating that the URL points to the same origin. When LoginController calls redirect()->intended(), Laravel passes absolute URLs through to the Location header unchanged, allowing an attacker-controlled URL to be reflected verbatim as the redirect target. An unauthenticated attacker can craft an IdP-initiated SSO link that causes a victim's browser to redirect to an arbitrary external URL immediately after successful authentication. The attack requires user interaction (visiting the crafted link) but no account on the target instance or IdP compromise. The fix, released in 8.7.0 (commit d30b73d, PR #19386), validates the RelayState value through Helper::sameOriginUrl before storing it, rejecting offsite hosts, dangerous schemes, and header-injection strings.
Affected products
- Snipe-IT Snipe-IT 8.5.0 through 8.6.3
Timeline
- 2026-09-09: disclosed: CVE-2026-86756 published
- 2026-08-24: patched: GitHub Security Advisory GHSA-68hq-m589-8q9j published; fix released in version 8.7.0 (commit d30b73d, PR #19386)