Sign in
Deutsch English Español Polski
Medium

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

  • Disclosed: 23.06.2026
  • Updated: 11.10.2026 10:22

Impact

POST /two-factor had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guesses. The TOTP implementation accepts the current code plus one step on either side (config/google2fa.php window=1), so at any instant 3 of 1,000,000 codes are accepted.

After a correct guess the attacker holds a fully authenticated session. If the instance is configured with 2FA in optional mode (two_factor_enabled='1'), the attacker can additionally disable 2FA via POST /account/profile with two_factor_optin=0. No OTP re-verification is required. The account is then accessible with the password alone on future logins. If 2FA is in required-for-all mode (='2'), the per-user opt-out path is closed and the impact stops at session-level account takeover. For an admin target, POST /api/v1/users/two_factor_reset additionally clears another user's 2FA secret.

Patches

Patched in v8.6.0

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package snipe/snipe-it < 8.6.0 8.6.0

References

CVSS score 5.9/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness (CWE)
CWE-770
Platform
Composer
Package
snipe/snipe-it
Disclosed
23.06.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mr8g-2mj4-pcq2 - CC BY 4.0

Vulnerability history: snipe/snipe-it

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (81) in the archive
Total entries
81
First → latest
10.2021 09.2026
Without a fix
6
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 23
  • Medium 53
  • Low 4

Disclosures per year

Severity:
  1. Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
    High · 8.7 CVE-2026-63498 < 8.7.0 8.7.0
  2. Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
    High · 8.1 CVE-2026-62368 < 8.7.0 8.7.0
  3. Snipe-IT: 2FA bypass via the API token flow
    High CVE-2026-63493 < 8.7.0 8.7.0
  4. Snipe-IT has an Improper Privilege Management issue
    High · 6.5 CVE-2026-55843 < 8.6.0 8.6.0
  5. Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
    High · 7.7 CVE-2026-55516 < 8.6.2 8.6.2
  6. Snipe-IT vulnerable to directory traversal in displaySig
    High CVE-2026-55474 < 8.5.0 8.5.0
  7. Snipe-IT has an authorization bypass on bulk editing users
    High · 7.1 CVE-2026-55460 < 8.6.2 8.6.2
  8. Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
    High CVE-2026-55694 < 8.6.3 8.6.3
  9. Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
    High CVE-2026-55643 < 8.6.3 8.6.3
  10. Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
    High · 8.5 CVE-2026-54329 < 8.6.2 8.6.2
  11. Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` this entry
    Medium · 5.9 CVE-2026-49870 < 8.6.0 8.6.0
  12. Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
    High · 7.1 CVE-2026-48507 < 8.6.0 8.6.0
  13. Snipe-IT has insecure permissions in file uploads
    Critical · 9.8 CVE-2026-37709 < 8.4.1 8.4.1
  14. Snipe-IT has Privilege Escalation via API Permissions Assignment
    High · 8.8 CVE-2026-44832 < 8.4.1 8.4.1
  15. Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
    High · 8.8 CVE-2025-15602 < 8.3.7 8.3.7
  16. Cross Site Scripting vulnerability in Snipe-IT
    High · 8.7 CVE-2024-51093 <= 7.0.13 no fix
  17. Snipe-IT remote code execution
    High · 7.2 CVE-2024-48987 < 7.0.10 7.0.10
  18. Snipe-IT allows users to promote or demote themselves or other users
    High · 8.1 CVE-2024-5685 < 6.4.2 6.4.2
  19. Cross-Site Request Forgery (CSRF) in snipe/snipe-it
    High · 8.8 CVE-2023-5511 < 6.2.3 6.2.3
  20. snipe-IT vulnerable to host header injection
    High · 8.8 CVE-2022-23064 >= 3.0-alpha, < 5.3.8 5.3.8
  21. Old sessions not blocked by login enable function in Snipe-IT
    High · 7.4 CVE-2022-1155 >= 6.0.0-RC-1, < 6.0.0-RC-6, < 5.4.2 6.0.0-RC-6, 5.4.2
  22. Improper Privilege Management in Snipe-IT
    High · 8.8 CVE-2022-0611 < 5.3.11 5.3.11
  23. snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
    High · 8.8 CVE-2021-4130 < 5.3.6 5.3.6
  24. Server-Side Request Forgery in snipe/snipe-it
    High · 7.2 CVE-2021-4075 < 6.0.0-GM 6.0.0-GM
  25. Cross-site Scripting in snipe/snipe-it
    High · 8.0 CVE-2021-3961 < 5.3.2 5.3.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.