CVE-2026-63493: Snipe-IT: 2FA bypass via the API token flow
2FA is enforced only by the web middleware group, not the api group, and the personal-access-token endpoint is in the api group. A session that has passed the password check but not the 2FA can mint a persistent API token and use it for full API access.
References
- github.com/advisories/GHSA-hxcx-9h4f-42xx
- github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e
- github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780
- github.com/grokability/snipe-it/pull/19294
- github.com/grokability/snipe-it/releases/tag/v8.7.0
- github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx
- nvd.nist.gov/vuln/detail/CVE-2026-63493
Code Behaviors & Features
Detect and mitigate CVE-2026-63493 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →