Snipe-IT EUVD-2026-109459

Three specific prerequisites from the advisory must all hold: (1) SAML SSO is enabled and configured (saml_enabled = 1 with valid IdP metadata) - this is a non-default deployment mode; (2) the attacker can obtain a single valid SAML assertion for the victim, which requires a privileged position or leak path (network MITM on the IdP-to-SP channel, a malicious browser extension, or an assertion exposed in logs or a Referer header); and (3) the attacker can submit that assertion twice within the sub-second race window against /saml/acs. Limiting factors that reduce realistic risk: exploitation only affects installs with SAML enabled, depends on first capturing a valid assertion (not something the attacker can generate), and is timing-dependent on winning a concurrency race. Affected versions are <= 8.4.1; fixed in 8.5.0.

Signals are mixed and point to a credible-but-conditional risk rather than a drop-everything emergency. The vendor/VulnCheck CVSS 4.0 base score is 8.7 (High) with VC:H/VI:H/VA:H, but the real-world impact is authentication bypass by capture-replay (CWE-294) compounded by a TOCTOU race (CWE-367), not loss of availability - note the input's 'Denial Of Service' tag contradicts both the CWEs and the advisory and should be disregarded. This is NOT in CISA KEV (no active-exploitation signal), no EPSS score was provided, and there is no confirmed working exploit code - only GHSA and VulnCheck advisory references exist, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today priority is 'this_week' (not act_now/emergency), which aligns with a serious flaw that still has meaningful preconditions. The biggest tempering factor is the prerequisite chain: the attacker must already possess a valid captured SAML assertion (MITM on the IdP-to-SP path, malicious browser extension, or log/Referer leak) AND win a sub-second concurrency race - conditions that make this better suited to targeted attacks than mass exploitation. One data tension to verify: the supplied CVSS 4.0 vector uses PR:L, but this is a capture-replay of a victim's assertion in which the attacker uses no credentials of their own, so the privilege framing is debatable - the capture/race requirement is more accurately modeled as attack complexity/requirement than as a privilege level.

An attacker positioned to observe one valid SAML assertion for a victim - via a network MITM on the IdP-to-SP path, a malicious browser extension, or an assertion leaked through logs or a Referer header - replays that single assertion concurrently from two separate cookie jars against /saml/acs. Because the nonce check and insert straddle Auth::login() without a transaction and the nonce column lacked a UNIQUE constraint, both requests pass the count-zero check and both establish authenticated sessions as the victim, and a later IdP-driven revocation clears only one of them. No confirmed public exploit code exists at the time of analysis; only vendor/VulnCheck advisories are referenced.