CVE-2026-63493

Snipe-IT: 2FA bypass via the API token flow

An attacker who knows a victim's password fully bypasses that account's 2FA and obtains a persistent token with full API access as the user (read and write across the user's permissions, including admin if the victim is an admin).

The token is an API credential, not a web/UI session (using it on web routes redirects to /login), but the REST API covers essentially the whole application. If the victim is an admin, the token can also call the admin users/two_factor_reset endpoint, which is in the same un-gated API surface, to clear the account's enrolled 2FA. The next login is then forced to re-enroll a second factor, which the password-holding attacker can complete with their own device, taking over the account's web access and locking the legitimate user out.

Kodem intelligence

Already deployed Kodem?

Fixed in commit 87c362962a via PR #19294 (FD-56499). The fix adds a new API-side middleware, EnforceApiTwoFactorEnrollment, registered on the api middleware group after auth:api. The new middleware answers the question "does this token's owner have a second factor enrolled at all?", which is orthogonal to the session-scoped 2fa_authed flag that CheckForTwoFactor relies on. Behavior:

• Passes through when there's no authenticated user (leaves the standard auth:api 401 in place).
• Passes through when two_factor_enabled is disabled in settings.
• Under optional mode (two_factor_enabled = '1'), only enforces on users who explicitly set two_factor_optin = '1', matching the web-side behavior and preserving legacy PATs for users who never opted in.
• Under required mode (two_factor_enabled = '2'), enforces regardless of optin.
• Blocks with 403 + Helper::formatStandardApiResponse('error', null, trans('auth/message.two_factor.please_enroll')) when the token owner's two_factor_enrolled != '1'.

Regression coverage lives in tests/Feature/Authentication/EnforceApiTwoFactorEnrollmentTest.php.

1. What is CVE-2026-63493? CVE-2026-63493 is a high-severity security vulnerability in snipe/snipe-it (composer), affecting versions < 8.7.0. It is fixed in 8.7.0.
2. Which versions of snipe/snipe-it are affected by CVE-2026-63493? snipe/snipe-it (composer) versions < 8.7.0 is affected.
3. Is there a fix for CVE-2026-63493? Yes. CVE-2026-63493 is fixed in 8.7.0. Upgrade to this version or later.
4. Is CVE-2026-63493 exploitable, and should I be worried? Whether CVE-2026-63493 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-63493 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-63493? Upgrade snipe/snipe-it to 8.7.0 or later.

Other vulnerabilities in snipe/snipe-it