CVE-2026-86770CWE-178

CVE-2026-86770

High · published September 9, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
46.5
In the wild
Unconfirmed
What it is

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00571 · 46.5th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2026-09-09T18:17Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.08.7.0
References (3)
https://github.com/grokability/snipe-it/security/advisories/GHSA-w3vv-5wxh-xg4h · [email protected]https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authentication-bypass-via-saml-username-collation · [email protected]https://github.com/grokability/snipe-it/security/advisories/GHSA-w3vv-5wxh-xg4h · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:32Z
    Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
    cvelistv5