CVE-2026-49870
Received Received - Intake

Two-Factor Authentication Bypass in Snipe-IT

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When two_factor_enabled is 1, POST /account/profile with two_factor_optin=0 can disable two-factor authentication without OTP reverification, while required mode 2 prevents that opt-out. An administrator can also use POST /api/v1/users/two_factor_reset to clear another user's secret. This issue is fixed in version 8.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-49870
EUVD
EUVD-2026-62676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snipe-it snipe-it 8.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49870 is a vulnerability in Snipe-IT versions prior to 8.6.0 where the /two-factor endpoint lacks rate limiting. This allows attackers with valid credentials to brute-force TOTP codes by submitting unlimited guesses. The system accepts three codes at a time (current, one before, one after), making it easier to crack the 1,000,000 possible codes. A successful guess grants full authenticated access to the account.

Detection Guidance

Monitor for excessive POST requests to /two-factor endpoint. Check logs for repeated TOTP verification attempts from the same IP or user ID. Use tools like fail2ban to detect brute-force patterns. Review authentication logs for sudden session creation after failed TOTP attempts.

Impact Analysis

If exploited, an attacker gains full access to your Snipe-IT account. If 2FA is optional, they can disable it without re-verifying, reducing future logins to just a password. In required 2FA mode, the impact is limited to session-level takeover. The vulnerability allows unauthorized access to sensitive IT asset and license management data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A successful breach could result in non-compliance, potential fines, and reputational damage.

Mitigation Strategies
  • Upgrade Snipe-IT to version 8.6.1 or later to apply the rate-limiting fix.
  • Set the environment variable TWO_FACTOR_MAX_ATTEMPTS_PER_MIN to a low value (e.g., 5) in the .env file to enforce rate limiting.
  • Enable and configure fail2ban to block IPs after repeated failed TOTP attempts.
  • Review and restrict access to the /two-factor endpoint via web server configuration.
  • Monitor for unauthorized session creation or profile changes that disable two-factor authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart