CVE-2026-86756

Name of the Vulnerable Software and Affected Versions Snipe-IT versions 8.5.0 through 8.6.3

Description An open redirect exists in the SAML assertion-consumer endpoint POST /saml/acs (handled by the SamlController::acs function). The issue occurs because the RelayState POST parameter is written directly into the url.intended session key with only CR/LF characters removed. Subsequently, the LoginController executes redirect()->intended(), which sends an absolute URL to the Location header without modification. An unauthenticated attacker can trick a user of an instance with SAML SSO enabled into visiting a crafted IdP-initiated SSO link, causing the browser to redirect to an arbitrary external URL after successful authentication. This can be used to facilitate credential-harvesting phishing attacks. No account on the target instance or compromise of the identity provider is necessary.

Recommendations Update to version 8.7.0. Restrict the use of the RelayState parameter in the POST /saml/acs endpoint until the update is applied.