Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.
| CVE | CVE-2026-116201 |
|---|---|
| Severidad | HIGH |
| CVSS | 8.8 / 10 |
| CWE | CWE-294 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Producto afectado
Snipe-IT 8.5.0
Producto derivado de la descripción (el CPE estructurado de NVD aún no está publicado).