CVE-2026-116199

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3

Description An authentication bypass exists in the handleGoogleCallback function of the GoogleAuthController. The system logs in users whose usernames match the Google account email without verifying the activated flag. This allows deactivated users who possess email-style usernames and active Google identities to sign in via Google SSO and regain sessions with their previous permission levels, including administrative access.

Recommendations Update to version 8.6.3.