https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:36:50 +0000 https://vulnerability.circl.lu/sighting/857263e5-5191-493b-9582-944e145f7945/export {"uuid": "857263e5-5191-493b-9582-944e145f7945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63493", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwpyjt5jaz2e", "content": "\ud83d\udccc CVE-2026-63493 - Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach ... https://www.cyberhub.blog/cves/CVE-2026-63493", "creation_timestamp": "2026-09-30T09:07:07.755078Z"} {"uuid": "857263e5-5191-493b-9582-944e145f7945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63493", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwpyjt5jaz2e", "content": "\ud83d\udccc CVE-2026-63493 - Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach ... https://www.cyberhub.blog/cves/CVE-2026-63493", "creation_timestamp": "2026-09-30T09:07:07.755078Z"} https://vulnerability.circl.lu/sighting/857263e5-5191-493b-9582-944e145f7945/export Wed, 30 Sep 2026 09:07:07 +0000 https://vulnerability.circl.lu/sighting/00710cd9-1a11-409e-81f3-b5ac93b61d9e/export {"uuid": "00710cd9-1a11-409e-81f3-b5ac93b61d9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63493", "type": "seen", "source": "https://gist.github.com/alon710/6b2fccc524523c2e698955d59741fc2e", "content": "# CVE-2026-63493: CVE-2026-63493: Multi-Factor Authentication Bypass via Stateless API Token Flow in Snipe-IT\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63493\n\n## Summary\nSnipe-IT prior to version 8.7.0 is vulnerable to an authentication bypass (CVE-2026-63493 / GHSA-hxcx-9h4f-42xx) within its Laravel Passport API integration. When multi-factor authentication (MFA/2FA) is enabled, an attacker possessing a victim's password can bypass MFA controls completely. This occurs because the Laravel middleware that enforces MFA was registered only in the stateful 'web' middleware group, leaving the stateless 'api' middleware group unguarded. Consequently, an attacker can use a valid password to initiate a session, bypass the MFA prompt on the web UI by communicating directly with the API, and generate a long-lived Personal Access Token (PAT) to perform unauthorized operations.\n\n## TL;DR\nFlawed session validation allows password-authenticated users to bypass multi-factor authentication (MFA) by interacting directly with the API middleware group to generate persistent access tokens.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-288\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.6 (High)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **EPSS Score**: Not available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Snipe-IT\n- **Snipe-IT**: < 8.7.0 (Fixed in: `8.7.0`)\n\n## Mitigation\n\n- Upgrade Snipe-IT to version 8.7.0 or higher.\n- Revoke all active Personal Access Tokens (PATs) for unverified or suspicious sessions.\n- Isolate the API endpoints (/api/v1/*) behind secure network perimeters such as VPNs or IP allowlists.\n\n**Remediation Steps:**\n1. Verify current Snipe-IT version in use.\n2. Apply the update to version 8.7.0 or later using official git or release channels.\n3. Inspect the database tables 'oauth_access_tokens' for any tokens created during the suspected compromise window.\n4. Enforce global 2FA and require all users to re-enroll if their settings were altered.\n5. Configure monitoring alerts on the /two_factor_reset API endpoint.\n\n## References\n\n- [GitHub Security Advisory GHSA-hxcx-9h4f-42xx](https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx)\n- [CVE Record CVE-2026-63493](https://www.cve.org/CVERecord?id=CVE-2026-63493)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63493) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T17:30:29.000000Z"} {"uuid": "00710cd9-1a11-409e-81f3-b5ac93b61d9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63493", "type": "seen", "source": "https://gist.github.com/alon710/6b2fccc524523c2e698955d59741fc2e", "content": "# CVE-2026-63493: CVE-2026-63493: Multi-Factor Authentication Bypass via Stateless API Token Flow in Snipe-IT\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63493\n\n## Summary\nSnipe-IT prior to version 8.7.0 is vulnerable to an authentication bypass (CVE-2026-63493 / GHSA-hxcx-9h4f-42xx) within its Laravel Passport API integration. When multi-factor authentication (MFA/2FA) is enabled, an attacker possessing a victim's password can bypass MFA controls completely. This occurs because the Laravel middleware that enforces MFA was registered only in the stateful 'web' middleware group, leaving the stateless 'api' middleware group unguarded. Consequently, an attacker can use a valid password to initiate a session, bypass the MFA prompt on the web UI by communicating directly with the API, and generate a long-lived Personal Access Token (PAT) to perform unauthorized operations.\n\n## TL;DR\nFlawed session validation allows password-authenticated users to bypass multi-factor authentication (MFA) by interacting directly with the API middleware group to generate persistent access tokens.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-288\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.6 (High)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **EPSS Score**: Not available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Snipe-IT\n- **Snipe-IT**: < 8.7.0 (Fixed in: `8.7.0`)\n\n## Mitigation\n\n- Upgrade Snipe-IT to version 8.7.0 or higher.\n- Revoke all active Personal Access Tokens (PATs) for unverified or suspicious sessions.\n- Isolate the API endpoints (/api/v1/*) behind secure network perimeters such as VPNs or IP allowlists.\n\n**Remediation Steps:**\n1. Verify current Snipe-IT version in use.\n2. Apply the update to version 8.7.0 or later using official git or release channels.\n3. Inspect the database tables 'oauth_access_tokens' for any tokens created during the suspected compromise window.\n4. Enforce global 2FA and require all users to re-enroll if their settings were altered.\n5. Configure monitoring alerts on the /two_factor_reset API endpoint.\n\n## References\n\n- [GitHub Security Advisory GHSA-hxcx-9h4f-42xx](https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx)\n- [CVE Record CVE-2026-63493](https://www.cve.org/CVERecord?id=CVE-2026-63493)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63493) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T17:30:29.000000Z"} https://vulnerability.circl.lu/sighting/00710cd9-1a11-409e-81f3-b5ac93b61d9e/export Thu, 24 Sep 2026 17:30:29 +0000 https://vulnerability.circl.lu/sighting/cc268604-429a-47d8-8d3a-21995e4c9109/export {"uuid": "cc268604-429a-47d8-8d3a-21995e4c9109", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63493", "type": "published-proof-of-concept", "source": "https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx", "content": "", "creation_timestamp": "2026-08-24T14:21:36.000000Z"} {"uuid": "cc268604-429a-47d8-8d3a-21995e4c9109", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63493", "type": "published-proof-of-concept", "source": "https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx", "content": "", "creation_timestamp": "2026-08-24T14:21:36.000000Z"} https://vulnerability.circl.lu/sighting/cc268604-429a-47d8-8d3a-21995e4c9109/export Mon, 24 Aug 2026 14:21:36 +0000