CVE-2026-116201
Received Received - Intake

SAML Assertion Replay in Snipe-IT

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116201
EUVD
EUVD-2026-109459

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grokability snipe-it 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116201 is a SAML assertion replay vulnerability in Snipe-IT versions before 8.5.0. It allows attackers to reuse captured SAML assertions by exploiting a race condition in the SAML assertion handler. The handler checks and inserts nonces non-atomically, so two concurrent requests with the same assertion can both pass validation, creating multiple authenticated sessions for the victim.

Detection Guidance

Monitor for unusual concurrent POST requests to /saml/acs endpoints. Check SAML logs for duplicate nonce values or rapid reuse of the same assertion. Inspect database entries in the saml_nonces table for non-unique nonce values or race conditions during authentication attempts.

Impact Analysis

An attacker could capture a valid SAML assertion for a victim and replay it in multiple concurrent requests to /saml/acs. This would create unauthorized authenticated sessions for the victim, bypassing IdP-driven revocation. The attacker gains access to the victim's account without needing their credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines authentication controls, potentially causing non-compliance with data protection regulations that mandate strong access controls and audit logging.

Mitigation Strategies

Upgrade Snipe-IT to version 8.5.0 or later immediately. Ensure the saml_nonces.nonce column has a unique constraint enforced. Review and restrict SAML SSO access until patched. Monitor for unauthorized session creation or duplicate nonce usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116201. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart