---
id: CVE-2026-86756
title: >-
  Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its
  SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs)
summary: >-
  Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its
  SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The
  endpoint wrote the RelayState POST parameter directly into Laravel's
  url.intended ses…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: snipeitapp
product: snipe-it
affected:
  - 'snipe-it >= 8.5.0, < 8.7.0'
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:25:23.380'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86756'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-68hq-m589-8q9j
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-8.5.0-through-8.6.3-open-redirect-via-saml-relaystate
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00332
epssPercentile: 0.23693
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T14:22:02.593775Z'
ingestedAt: '2026-09-12T20:10:27.176Z'
---

## Overview

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and LoginController later issued redirect()->intended(), which passes an absolute URL through to the Location header unchanged. An unauthenticated attacker who induces a user of a SAML-SSO-enabled instance to visit a crafted IdP-initiated SSO link can therefore cause the victim's browser to be redirected to an arbitrary absolute external URL immediately after a successful authentication, which the advisory notes facilitates credential-harvesting phishing. No account on the target instance and no compromise of the identity provider are required. Only deployments with SAML SSO enabled are affected. Fixed in 8.7.0 (commit d30b73d, PR #19386), which validates RelayState via a new Helper::sameOriginUrl check before storing it.

## Affected

- `snipe-it >= 8.5.0, < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`