CVE-2026-63493

Analyzed Analyzed - Analysis Complete

Authentication Bypass via API Token in Snipe-IT

Publication date: 2026-09-24

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-29

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-63493

EUVD

EUVD-2026-86291

Affected Vendors & Products

Vendor	Product	Version / Range
snipeitapp	snipe-it	to 8.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

CVE-2026-63493 is a vulnerability in Snipe-IT, an IT asset management system. It allows an attacker with a victim's password to bypass two-factor authentication (2FA) via the API token flow before the victim completes their 2FA challenge. The attacker can then obtain a persistent API token with full read and write access, including admin privileges if the victim is an admin. The vulnerability exists because 2FA enforcement was only applied to web sessions, not API sessions.

Detection Guidance

Check Snipe-IT version with `php artisan version` or via the web UI. If version is below 8.7.0, the system is vulnerable. Review API logs for unauthorized PAT creation attempts or access to sensitive endpoints like users/two_factor_reset.

Impact Analysis

If you are a Snipe-IT user with self.api permission, an attacker who knows your password could exploit this to gain persistent API access with your permissions. For administrators, this could lead to account takeover by resetting your 2FA, enrolling their own device, and locking you out of your account. The API token remains valid even while your web session is blocked at the 2FA prompt.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by allowing unauthorized API access to sensitive data. If an attacker exploits this flaw to gain admin-level API access, they could read or modify personal or health-related information without detection, breaching confidentiality and integrity requirements. The lack of enforced 2FA for API tokens undermines security controls mandated by these regulations.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately.
Rotate all existing Personal Access Tokens (PATs) after upgrade.
Enforce 2FA for all users via system settings.
Audit API access logs for suspicious activity prior to upgrade.

Hi! I’m here to help you understand CVE-2026-63493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70