CVE-2026-116201

The record

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.

Affected packages

Related vulnerabilities

• CVE-2026-104381 A missing authentication vulnerability in Fireware OS's FireCluster state synchronization… CWE-294
• CVE-2026-41020 Eaton easyE4 uses a static nonce during authentication, which could allow an… CWE-294
• CVE-2026-117470 Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn… CWE-294
• CVE-2026-65824 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-294
• CVE-2026-114617 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-294
• CVE-2026-87952 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service… CWE-294
• CVE-2026-103314 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). CWE-294
• CVE-2026-73636 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation… CWE-294