CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

What is CVE-2026-116199?

CVE-2026-116199 is a critical vulnerability in Snipeitapp Snipe-It, published on 25 Oct 2026.

Official description

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.

Weakness: CWE-285

Which versions are affected by CVE-2026-116199?

It affects 1 product.

Products include Snipeitapp Snipe-It.

How do I fix CVE-2026-116199?

No fix has been published for CVE-2026-116199 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116199 being exploited?

There is no known exploitation of CVE-2026-116199 in the wild and no public exploit code.

Other vulnerabilities in Snipeitapp Snipe-It

• CVE-2025-63601 File upload in n/a Critical 9.9
• CVE-2026-37709 Snipe-IT has insecure permissions in file uploads Critical 9.8
• CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS Critical 9.3
• CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it Critical 9.1
• CVE-2022-1445 Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it Critical 9.0

All Snipeitapp Snipe-It vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-9cjx-rmhj-qc37, GHSA-xf36-wx48-5rqp.