CVE-2026-44833: Snipe-IT Open Redirect Vulnerability

CVE-2026-44833 Overview

CVE-2026-44833 is an open redirect vulnerability in Snipe-IT, an open-source IT asset and license management system. Versions prior to 8.4.1 store the HTTP Referer header in a session variable without validation. Attackers can craft links that cause Snipe-IT to redirect authenticated users to attacker-controlled domains after interaction. The flaw maps to CWE-601: URL Redirection to Untrusted Site and supports phishing and credential harvesting campaigns that abuse the trusted Snipe-IT origin. The maintainers fixed the issue in version 8.4.1.

Critical Impact
Attackers can redirect authenticated Snipe-IT users to malicious sites through an unvalidated Referer header, enabling phishing against asset administrators.

Affected Products

Snipe-IT versions prior to 8.4.1
Vendor: snipeitapp
CPE: cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*

Discovery Timeline

2026-05-26 - CVE-2026-44833 published to NVD
2026-05-26 - Last updated in NVD database
Patch released - Snipe-IT 8.4.1 published via GitHub Security Advisory GHSA-mghp-5cq4-v6mg

Technical Details for CVE-2026-44833

Vulnerability Analysis

Snipe-IT captures the inbound HTTP Referer header and persists it in a server-side session variable. The application later uses this stored value as a redirect target without validating that the destination resolves to a Snipe-IT origin. Because the Referer header is attacker-controllable, a crafted request can poison the session with an external URL. When the workflow performs the redirect, the user's browser is sent off-site while still trusting the Snipe-IT domain that initiated the navigation. The classification of [CWE-601] reflects the lack of allow-list checks on outbound redirect targets.

Root Cause

The root cause is missing validation on the Referer header before it is written to the session and later consumed as a redirect URL. The code path treats client-supplied data as a trusted internal navigation hint. No host comparison, relative-path enforcement, or signed-token gating is applied prior to redirection.

Attack Vector

Exploitation requires user interaction over the network. An attacker hosts a page that issues a request to Snipe-IT with a malicious Referer value, or sends a victim a link that triggers a Snipe-IT flow which reads and reuses the stored referer. The victim, already authenticated to Snipe-IT, is then redirected to an attacker-controlled domain that mimics the Snipe-IT login or single sign-on page. The attacker captures credentials, session tokens, or delivers follow-on payloads. No verified proof-of-concept code is publicly available. See the vendor commit for the corrective logic.

Detection Methods for CVE-2026-44833

Indicators of Compromise

Outbound HTTP redirects from Snipe-IT responses whose Location header points to external domains not in your organization's allow-list.
Inbound requests to Snipe-IT containing Referer headers with unexpected external hosts, especially before authentication flows.
Spikes in Snipe-IT user logins originating from off-platform referrers shortly after session redirects.

Detection Strategies

Parse Snipe-IT web server access logs for HTTP 30x responses where the Location header host differs from the Snipe-IT canonical hostname.
Correlate session identifiers across requests to find sessions where a stored referer was set from an external origin and later used as a redirect target.
Deploy a web application firewall rule that flags Referer headers containing fully qualified URLs to domains outside the organization.

Monitoring Recommendations

Monitor Snipe-IT version banners across the estate and alert on instances running below 8.4.1.
Track user-reported phishing pages that imitate Snipe-IT login screens and pivot back to redirect logs.
Enable identity provider logging for anomalous Snipe-IT authentication attempts from new geographies or user agents following a redirect event.

How to Mitigate CVE-2026-44833

Immediate Actions Required

Upgrade all Snipe-IT instances to version 8.4.1 or later, which contains the validation fix.
Invalidate active Snipe-IT sessions after the upgrade to clear any poisoned Referer values stored server-side.
Notify Snipe-IT users to verify the browser address bar before submitting credentials following any redirect.

Patch Information

The fix is published in Snipe-IT 8.4.1. The corrective change is documented in GitHub commit e3764921 and the GitHub Security Advisory GHSA-mghp-5cq4-v6mg. Apply the upgrade through your standard package management workflow and restart the application service.

Workarounds

Place Snipe-IT behind a reverse proxy or WAF that strips or rewrites externally sourced Referer headers before they reach the application.
Restrict outbound redirects at the proxy layer by blocking HTTP Location headers that point to domains outside the organization's approved list.
Train asset administrators to access Snipe-IT only through bookmarks rather than third-party links until the patch is deployed.

bash

# Example nginx rule to drop external Referer headers before reaching Snipe-IT
location / {
    if ($http_referer !~* "^https?://(snipeit\.example\.com|localhost)") {
        proxy_set_header Referer "";
    }
    proxy_pass http://snipeit_backend;
}