Technical impact
Snipe‑IT versions prior to 8.5.0 contain a race condition in the SAML assertion consumer service that allows an attacker to replay a captured SAML assertion. This flaw bypasses the non‑atomic nonce check, enabling the same assertion to be accepted multiple times and thus granting concurrent authenticated sessions to the attacker without triggering identity‑provider revocation. The vulnerability is a form of improper authentication and results in elevated access rights for the attacker.
Affected Systems
The vulnerability affects the Snipe‑IT asset‑management application provided by grokability. All releases before 8.5.0 are vulnerable; version 8.5.0 and later incorporate a fixed atomic nonce check.
Risk and Exploitability
The flaw has a CVSS score of 8.7, indicating a high level of severity. Although the EPSS score is not available, the lack of any listed exploitation data in the KEV catalog and the purely remote nature of the attack suggest a moderate likelihood of exploitation, especially against exposed instances. Attackers only need to capture a valid SAML assertion and then send concurrent POST requests to the /saml/acs endpoint to achieve the replay effect.
