{"id":"CVE-2026-116199","title":"Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback","summary":"Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with em…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-285"],"vendor":"grokability","product":"snipe-it","affected":["snipe-it < 8.6.3"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T13:20:31.815Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116199","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xf36-wx48-5rqp","label":"GitHub Security Advisory (GHSA-xf36-wx48-5rqp)"},{"url":"https://www.vulncheck.com/advisories/snipe-it-before-8.6.3-authentication-bypass-via-google-sso-callback","label":"VulnCheck Advisory: Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback"}],"tags":["cve.org"],"ingestedAt":"2026-10-25T22:08:29.940Z","slug":"CVE-2026-116199","body":"## Overview\n\nSnipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.\n\n## Affected\n\n- `snipe-it < 8.6.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}