CVE-2026-116199
Received Received - Intake

Authentication Bypass in Snipe-IT via Google SSO

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116199
EUVD
EUVD-2026-109457

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grokability snipe-it 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Snipe-IT versions before 8.6.3. It occurs in the Google SSO callback function, allowing deactivated users with email-shaped usernames to log in by matching their Google account email without verifying account activation status. This grants them access at their original permission level, including admin rights.

Detection Guidance

Check Snipe-IT version with composer show snipe/snipe-it or view the version in the web interface footer. Inspect Google SSO login attempts in logs for deactivated users with email-shaped usernames successfully authenticating. Review user sessions for unexpected admin-level access from previously deactivated accounts.

Impact Analysis

This vulnerability allows deactivated users to regain unauthorized access to the system, bypassing offboarding processes. Attackers could exploit this to regain admin privileges, access sensitive data, or perform actions as if they were active users. Systems using email-as-username or email-shaped usernames are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA. It undermines access control policies, potentially resulting in data breaches, non-compliance with audit logs, and failure to enforce proper user deactivation procedures.

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.3 or later immediately. Disable Google SSO temporarily if possible until upgrade is complete. Audit all user accounts, especially those with email-shaped usernames, and verify activation status. Rotate any credentials that may have been exposed during unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116199. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart