Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116199— Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Quick assessment

Affected
grokability snipe-it
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Snipe-IT 8.6.3 之前的版本在 方法中存在身份验证绕过漏洞。该漏洞允许系统在不检查“已激活”标志的情况下，登录用户名与 Google 账户邮箱相匹配的用户。因此，那些用户名呈邮箱格式但已被停用、且其 Google 身份仍然有效的用户，可以通过 Google 单点登录（SSO）重新登录，并恢复其原有的权限级别，包括管理员权限。

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116199

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
Source: CVE Program / CVE List V5
Vulnerability Description
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
grokability snipe-it 0 ~ 8.6.3 -

II. Public POCs for CVE-2026-116199

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116199

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116199 (2)

Same Patch Batch · grokability · 2026-10-25 · 4 CVEs total

CVE-2026-116201 8.8 HIGH Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
CVE-2026-116200 5.9 MEDIUM Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
CVE-2026-116198 4.3 MEDIUM Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

IV. Related Vulnerabilities

Same product: snipe-it
Same vendor: grokability
Same weakness: CWE-285