Description

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-09T14:17:24.590Z",
  "pubdate": "2026-09-09T14:17:24.590Z",
  "executiveSummary": "This vulnerability involves an improper authorization control in Snipe-IT versions prior to 8.7.0, specifically regarding Laravel Passport's OAuth client management routes. The flaw permits any authenticated user, regardless of their privilege level, to register arbitrary OAuth clients with attacker-controlled redirect URIs. This represents a significant security risk, as it allows for the potential hijacking of administrative sessions. By tricking an administrator into approving an OAuth consent screen, an attacker can obtain an authorization code, which is then exchanged for a bearer token. This token grants the attacker the full API permissions of the administrative user. Given that these tokens can be configured with a lifespan of up to 40 years, the potential for long-term persistence and unauthorized administrative access is extremely high, undermining the integrity and confidentiality of the entire Snipe-IT instance.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization gate on the Laravel Passport OAuth client management endpoints within the Snipe-IT application. While these routes are intended to be restricted to administrative users capable of managing OAuth applications, the application fails to enforce these role-based access control (RBAC) checks, allowing any authenticated user to interact with the client registration logic.\nThe exploitation flow proceeds as follows: First, an authenticated attacker initiates a request to the vulnerable OAuth client registration route. Because the application fails to validate the user's authorization level against this endpoint, the request is processed, allowing the attacker to register a new OAuth client. During this registration, the attacker specifies a malicious redirect URI under their control.\nSecond, the attacker leverages social engineering to lure a Snipe-IT administrator to a crafted authorization URL associated with the newly registered malicious OAuth client. When the administrator visits this URL, they are presented with the standard OAuth consent screen. If the administrator approves the request, the application issues an authorization code, which is then redirected to the attacker-controlled URI.\nThird, the attacker intercepts this authorization code and exchanges it for a valid OAuth bearer token by communicating with the Laravel Passport token endpoint. Because the authorization process was approved by an administrative account, the resulting bearer token inherits the full API permissions and privileges associated with that administrator's account.\nThe impact of this successful exploitation is severe. The attacker gains the ability to perform any action the administrator can perform via the Snipe-IT API. Furthermore, because these tokens can be configured with an exceptionally long validity period, often up to 40 years, the attacker establishes persistent, unauthorized access to the application, bypassing subsequent password changes or session invalidations. This effectively grants the attacker a permanent administrative backdoor until the client or token is explicitly revoked by an administrator."
}