CVE-2026-63493: Snipe-IT: 2FA bypass via the API token flow
2FA is enforced only by the web middleware group, not the api group, and the personal-access-token endpoint is in the api group. A session that has passed the password check but not the 2FA can mint a persistent API token and use it for full API access.
References
- github.com/advisories/GHSA-hxcx-9h4f-42xx
- github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e
- github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780
- github.com/grokability/snipe-it/pull/19294
- github.com/grokability/snipe-it/releases/tag/v8.7.0
- github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx
- nvd.nist.gov/vuln/detail/CVE-2026-63493
Code Behaviors & Features
Detect and mitigate CVE-2026-63493 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →