CVE-2026-49870

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.1

Description The application lacks rate limiting, lockout mechanisms, or attempt counters on the 'POST /two-factor' endpoint. This allows an attacker possessing valid credentials to perform an unlimited number of Time-based One-Time Password (TOTP) guesses. Because the system accepts the current code and one step on either side as defined in config/google2fa.php window=1, three possible codes are valid at any given time. A successful guess results in a fully authenticated session. If the two factor enabled variable is set to 1, an attacker can disable two-factor authentication via the 'POST /account/profile' endpoint by setting the two factor optin variable to 0 without requiring OTP re-verification. Additionally, an administrator can clear another user's secret using the 'POST /api/v1/users/two factor reset' endpoint.

Recommendations Update to version 8.6.1.