CVE-2026-86756: Snipe-IT SAML Open Redirect Vulnerability

CVE-2026-86756 Overview

CVE-2026-86756 is an open redirect vulnerability [CWE-601] in Snipe-IT versions 8.5.0 through 8.6.3. The flaw resides in the SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint writes the RelayState POST parameter directly into Laravel's url.intended session key after stripping only carriage-return and line-feed characters. When LoginController later invokes redirect()->intended(), an absolute URL passes unchanged into the HTTP Location header. Only deployments with SAML single sign-on (SSO) enabled are affected.

Critical Impact
An unauthenticated attacker can redirect authenticated users to an attacker-controlled external URL immediately after login, enabling credential-harvesting phishing without compromising the identity provider.

Affected Products

Snipe-IT 8.5.0
Snipe-IT versions 8.5.x and 8.6.x through 8.6.3
Snipe-IT deployments with SAML SSO enabled

Discovery Timeline

2026-09-09 - CVE-2026-86756 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86756

Vulnerability Analysis

The vulnerability sits in Snipe-IT's SAML assertion-consumer service (ACS). During IdP-initiated SSO, the identity provider posts a SAMLResponse and a RelayState value to /saml/acs. Snipe-IT stores RelayState in the Laravel session under the url.intended key with only CR/LF stripping applied.

After authentication completes, LoginController calls Laravel's redirect()->intended() helper. That helper accepts an absolute URL and emits it verbatim in the Location response header. No same-origin or allow-list check is performed before the redirect.

A remote attacker crafts an IdP-initiated SSO URL that embeds a hostile absolute URL as RelayState. When a victim follows the link and successfully authenticates through the legitimate identity provider, the browser is redirected to the attacker's site. The advisory notes this facilitates credential-harvesting phishing that appears to originate from the trusted Snipe-IT origin.

Root Cause

The root cause is missing origin validation on user-supplied redirect input [CWE-601]. Snipe-IT sanitized RelayState only for header-splitting characters and treated the value as trusted for redirect purposes. The fixed release, Snipe-IT 8.7.0 (commit d30b73d, PR #19386), introduces a Helper::sameOriginUrl check that validates RelayState against the application origin before storing it.

Attack Vector

Exploitation requires user interaction but no account on the target instance and no compromise of the identity provider. The attacker distributes a crafted IdP-initiated SSO link, typically via email or messaging. When the victim authenticates, Snipe-IT redirects the browser to the attacker's external URL, which can host a lookalike login page or malware delivery content.

The vulnerability manifests through unsafe reuse of the RelayState parameter. See the GitHub Security Advisory GHSA-68hq-m589-8q9j and the Vulncheck Advisory for the full technical write-up.

Detection Methods for CVE-2026-86756

Indicators of Compromise

HTTP 302 responses from /saml/acs flows where the subsequent Location header points to an external domain not owned by the organization.
SAML RelayState values in web server logs containing absolute URLs with schemes such as http:// or https:// pointing off-origin.
Inbound phishing emails containing IdP-initiated SSO links to the Snipe-IT tenant with unusual RelayState query or form parameters.

Detection Strategies

Parse web application and reverse-proxy logs for POST requests to /saml/acs and correlate the request's RelayState value with the immediately following Location header.
Alert on any post-authentication redirect whose destination host does not match the Snipe-IT canonical hostname.
Hunt for repeated ACS submissions with varying RelayState values from the same source, which suggests reconnaissance.

Monitoring Recommendations

Enable verbose logging on the Snipe-IT reverse proxy to capture request bodies or at minimum RelayState values.
Forward web logs to a centralized analytics platform and build a rule for external-origin redirects following /saml/acs.
Monitor identity provider logs for IdP-initiated flows targeting Snipe-IT and cross-reference against user-reported phishing.

How to Mitigate CVE-2026-86756

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which includes commit d30b73d and PR #19386.
If SAML SSO is not required, disable it on affected instances until the upgrade completes.
Notify users of the risk of clicking unsolicited Snipe-IT SSO links and reinforce phishing reporting workflows.

Patch Information

The fix landed in Snipe-IT 8.7.0 via PR #19386 (commit d30b73d). The patch adds a Helper::sameOriginUrl validation step that rejects RelayState values not matching the application's own origin before writing them into the url.intended session key. Details are documented in the GitHub Security Advisory GHSA-68hq-m589-8q9j.

Workarounds

Configure a web application firewall (WAF) rule to strip or block RelayState values on /saml/acs that contain :// or begin with //.
Restrict outbound redirects at the reverse proxy by rewriting off-origin Location headers on responses from /saml/acs.
Temporarily disable SAML SSO and require local authentication until the upgrade to 8.7.0 is applied.

bash

# Example nginx rule to block off-origin RelayState on /saml/acs
location = /saml/acs {
    if ($request_body ~* "RelayState=[^&]*(%3A%2F%2F|://|%2F%2F)") {
        return 400;
    }
    proxy_pass http://snipeit_upstream;
}