Advisory · CVE-2026-116201
Snipe-IT SAML assertions can be replayed concurrently to mint extra victim sessions
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability: the nonce check in the SAML acs handler is non-atomic and the nonce column has no unique constraint, so concurrent requests carrying one captured assertion can each obtain an authenticated victim session that evades identity-provider-driven revocation. CVSS 3.1 8.8.
- Vendor
- Snipe-IT
- Product
- Snipe-IT
- Identifier / CWE
- CVE-2026-116201
CWE-294 - Action timing
- Immediate
Explain it like I’m five
Snipe-IT checks a SAML ticket against a used-ticket list before stamping it, but two copies presented at the same instant both pass the check before either stamp lands, so one ticket becomes two entrances.
- 01Assertion is captured
An attacker obtains one valid SAML assertion for a victim, for example through a network position, a malicious extension, or a log or referrer leak.
- 02Copies race the handler
The attacker submits concurrent POST requests to the SAML acs endpoint carrying the same captured assertion from separate cookie jars.
- 03Nonce check is beaten
Both requests pass the count-zero nonce check before either inserts its nonce, because the check and insert are not atomic and the column has no unique constraint.
- 04Parallel sessions issued
Both requests log in as the victim, yielding multiple authenticated sessions from one assertion, and later revocation reaches only one of them.
What happened
Snipe-IT disclosed CVE-2026-116201 in its GitHub security advisory. The SAML acs handler deduplicates replayed assertions with a check-then-insert pattern against the saml_nonces table, but the nonce column carried a non-unique index rather than a unique constraint, and the check and insert straddled the login call without a transaction. Two concurrent requests with the same captured assertion could both pass the check, both log in, and both insert the nonce, yielding two parallel authenticated sessions for the victim from a single captured assertion.
The vendor advisory scopes the affected versions to 8.4.1 and earlier and states the issue is patched in 8.5.0 and later, with an insert-first approach at the application layer and a unique constraint on the nonce column at the schema layer. It states the exploitability conditions plainly: SAML SSO enabled and configured, an attacker who can obtain a single valid assertion for the victim, and the ability to submit it twice within the race window. It also notes the consequence that identity-provider-driven session revocation reaches only one of the resulting sessions.
What to do
- Inventory Snipe-IT instances with SAML SSO enabled; instances without SAML configured are outside the vendor-stated scope.
- Upgrade affected instances to Snipe-IT 8.5.0 or later; upgrading to the current 8.6.3 line also covers the separate Google SSO advisory published today.
- Review SAML login records for near-simultaneous acs requests presenting the same assertion, and for one user holding unexpected parallel sessions.
- Revoke all active sessions for any victim account with duplicate-session evidence, not just the most recent session.
- Protect assertion confidentiality in transit and in logs, since one captured assertion is the input this flaw needs.
Management note
Replay protection that depends on timing is not replay protection. Patch, then remember the second-order effect: sessions minted this way survive the revocation you would normally trust, so session cleanup has to be part of the response.