CVE-2026-63493: Multi-Factor Authentication Bypass via Stateless API Token Flow in Snipe-IT
Vulnerability ID: CVE-2026-63493
CVSS Score: 8.6
Published: 2026-09-24
Snipe-IT prior to version 8.7.0 is vulnerable to an authentication bypass (CVE-2026-63493 / GHSA-hxcx-9h4f-42xx) within its Laravel Passport API integration. When multi-factor authentication (MFA/2FA) is enabled, an attacker possessing a victim's password can bypass MFA controls completely. This occurs because the Laravel middleware that enforces MFA was registered only in the stateful 'web' middleware group, leaving the stateless 'api' middleware group unguarded. Consequently, an attacker can use a valid password to initiate a session, bypass the MFA prompt on the web UI by communicating directly with the API, and generate a long-lived Personal Access Token (PAT) to perform unauthorized operations.
TL;DR
Flawed session validation allows password-authenticated users to bypass multi-factor authentication (MFA) by interacting directly with the API middleware group to generate persistent access tokens.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-288
- Attack Vector: Network (AV:N)
- CVSS v4.0 Score: 8.6 (High)
- Exploit Status: Proof-of-Concept (PoC) available
- EPSS Score: Not available
- CISA KEV Status: Not listed
Affected Systems
- Snipe-IT
-
Snipe-IT: < 8.7.0 (Fixed in:
8.7.0)
Code Analysis
Commit: 87c3629
Enforce API 2FA enrollment middleware registration in Kernel.php and add check for optional vs required modes.
Commit: c4ea7db
Add regression tests for EnforceApiTwoFactorEnrollment middleware.
Mitigation Strategies
- Upgrade Snipe-IT to version 8.7.0 or higher.
- Revoke all active Personal Access Tokens (PATs) for unverified or suspicious sessions.
- Isolate the API endpoints (/api/v1/*) behind secure network perimeters such as VPNs or IP allowlists.
Remediation Steps:
- Verify current Snipe-IT version in use.
- Apply the update to version 8.7.0 or later using official git or release channels.
- Inspect the database tables 'oauth_access_tokens' for any tokens created during the suspected compromise window.
- Enforce global 2FA and require all users to re-enroll if their settings were altered.
- Configure monitoring alerts on the /two_factor_reset API endpoint.
References
Read the full report for CVE-2026-63493 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)