Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When two_factor_enabled is 1, POST /account/profile with two_factor_optin=0 can disable two-factor authentication without OTP reverification, while required mode 2 prevents that opt-out. An administrator can also use POST /api/v1/users/two_factor_reset to clear another user's secret. This issue is fixed in version 8.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-19T19:17:17.770Z",
  "pubdate": "2026-08-19T19:17:17.770Z",
  "executiveSummary": "Snipe-IT prior to version 8.6.1 suffers from multiple security deficiencies related to two-factor authentication (2FA) implementation, encompassing missing rate limiting, improper authorization controls, and lack of re-verification mechanisms.\nThe vulnerability allows an authenticated attacker to perform brute-force attacks against Time-based One-Time Password (TOTP) codes at the POST /two-factor endpoint due to the absence of rate limiting, lockout mechanisms, or attempt counters, compounded by a window=1 configuration defined in config/google2fa.php that accepts three potential codes.\nFurthermore, when two_factor_enabled is set to 1, users can disable 2FA via a POST request to /account/profile with two_factor_optin=0 without requiring OTP reverification. Additionally, administrators can clear another user's secret utilizing the POST /api/v1/users/two_factor_reset API endpoint.\nSuccessful exploitation of these combined weaknesses can lead to unauthorized session establishment, compromise of user accounts, and complete bypass of secondary authentication controls across affected Snipe-IT instances.\nRemediation requires upgrading the Snipe-IT installation to version 8.6.1 or later, where these authentication and rate-limiting issues are formally resolved.",
  "technicalDetails": "The vulnerabilities reside within the authentication and user management components of Snipe-IT prior to version 8.6.1, specifically affecting the POST /two-factor endpoint, the POST /account/profile endpoint, and the POST /api/v1/users/two_factor_reset API route.\nThe root cause of the brute-force vector is the total lack of rate limiting, account lockout functionality, or attempt tracking on the POST /two-factor endpoint. Coupled with the configuration parameter window=1 specified in config/google2fa.php, the application validates a sliding window of three acceptable TOTP codes for any single verification attempt.\nAn attacker possessing valid primary credentials can initiate an attack flow by submitting rapid, unlimited TOTP guesses to the POST /two-factor endpoint. Because the application processes these requests without throttling or locking out the session after failed attempts, the attacker can systematically iterate through potential TOTP values within the accepted window until a successful guess establishes a fully authenticated session.\nA secondary vulnerability involves the POST /account/profile endpoint. When two_factor_enabled is configured to 1, a user can submit two_factor_optin=0 to disable 2FA protections entirely. Crucially, this state change does not enforce multi-factor re-verification, permitting unauthorized disabling of security controls if session integrity is otherwise compromised.\nA tertiary administrative vector exists via the POST /api/v1/users/two_factor_reset endpoint, which allows administrators to clear another user's stored TOTP secret without stringent secondary verification checks.\nNetwork exposure is defined by the web accessibility of the Snipe-IT application instance over HTTP/HTTPS protocols. Attack requirements dictate that the threat actor must either possess valid primary credentials to reach the TOTP validation stage or leverage administrative privileges to invoke the reset functionality."
}