Description

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-09T14:17:27.593Z",
  "pubdate": "2026-09-09T14:17:27.593Z",
  "executiveSummary": "Snipe-IT versions prior to 8.7.0 are susceptible to an authentication bypass vulnerability stemming from improper validation of username case sensitivity during SAML, LDAP, and OAuth federated login processes.\nThe vulnerability arises from the underlying database collation configuration (utf8mb4_unicode_ci), which treats certain character variants as equivalent during equality checks.\nThis flaw allows a remote, unauthenticated attacker to successfully impersonate a legitimate user by registering or utilizing an Identity Provider (IdP) account with a username that is a case or accent-based variant of a victim's account.\nSuccessful exploitation results in unauthorized account takeover, granting the attacker the identity and associated privileges of the targeted victim within the Snipe-IT environment.\nThe risk is critical, as it bypasses standard identity assurance mechanisms provided by federated protocols, effectively subverting the authentication boundary for integrated enterprise SSO systems.",
  "technicalDetails": "The root cause of this vulnerability is a logic flaw in the application's authentication reconciliation process combined with the behavior of the database layer. When Snipe-IT processes incoming assertions from SAML, LDAP, or OAuth providers, it performs a lookup to match the incoming identifier against existing records in the user database.\nThe application relies on the database's collation settings, specifically utf8mb4_unicode_ci, to handle string comparisons. This collation type is designed for linguistic correctness rather than binary exactness, causing the database to equate characters with different accents or cases (e.g., 'user' vs 'Usér') as identical during a SELECT or WHERE query.\nBecause the application logic does not perform a secondary, case-sensitive application-level validation or canonicalization check before mapping the federated identity to the local user record, it accepts the variant username as a valid match for the victim's account.\nThe attack flow proceeds as follows: First, the attacker identifies a target username within the Snipe-IT instance. Second, the attacker registers or authenticates through a federated IdP using a modified version of that username—for instance, changing the case of a letter or introducing a Unicode accent variant that the database collation deems equivalent. Third, the attacker initiates a login request via the affected path (SAML, LDAP, or OAuth). Finally, Snipe-IT receives the assertion, executes a database query that evaluates the variant as a match for the victim's account due to the lenient collation, and grants the attacker an authenticated session associated with the target's account credentials.\nThis vulnerability is particularly impactful because it does not require direct access to the database, but rather exploits the integration logic of federated authentication flows. The exploitation requires the attacker to have the ability to provision or control an identity within the organization's connected IdP. Once authenticated as the victim, the attacker gains full access to all resources, administrative permissions, and sensitive asset management data tied to the victim's account, potentially leading to a complete compromise of the asset management system's integrity and confidentiality."
}