CVE-2026-116199(snipeitapp / snipe-it)

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.

snipeitapp CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

snipe-it

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Affected systems

Vendors

snipeitapp

Products

snipe-it

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://thecircuitry.to/article/snipe-it-before-863-deactivated-users-can-sign-back-in-via-google-sso-cve-2026-1-mvnxf9vy?utm_source=x&utm_medium=social&utm_campaign=xavier&utm_content=snipeit-sso

Full discourse1 post

Xavier Rivera@XavierRiveraX1d
Snipe-IT before 8.6.3 let deactivated users sign back in through Google SSO with their old permissions, admin included (CVE-2026-116199). The SSO callback matched the Google email to a username and never checked if the account was still active. Only hits installs with Google SSO on and email-style usernames. Fixed in 8.6.3. Offboarding isn't done until the IdP account is dead too. https://thecircuitry.to/article/snipe-it-before-863-deactivated-users-can-sign-back-in-via-google-sso-cve-2026-1-mvnxf9vy?utm_source=x&utm_medium=social&utm_campaign=xavier&utm_content=snipeit-sso
0000079
603 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	snipeitapp	snipe-it	-	-	-

Explore more

Back to dashboard snipeitapp CVEs snipe-it vulnerabilities