CVE-2026-49870
MediumCVSS 5.9Summary
Snipe-IT prior to 8.6.1 has a vulnerability in POST /two-factor with no rate limiting, lockout, or attempt counter, allowing unlimited TOTP guesses. It also allows disabling 2FA without OTP reverification in certain modes.
Risk Assessment
The risk includes session takeover via TOTP brute-force and disabling 2FA, potentially leading to unauthorized access.
Recommendation
Update to version 8.6.1 or later and implement rate limiting and lockout for TOTP attempts, and require OTP reverification when disabling 2FA.
Original NVD description (English source)
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When two_factor_enabled is 1, POST /account/profile with two_factor_optin=0 can disable two-factor authentication without OTP reverification, while required mode 2 prevents that opt-out. An administrator can also use POST /api/v1/users/two_factor_reset to clear another user's secret. This issue is fixed in version 8.6.1.