The flaw exists in the POST /two‑factor endpoint of Snipe‑IT, which accepts three potential TOTP codes without any limit on the number of attempts. An attacker who already possesses valid user credentials can therefore try unlimited TOTP guesses. Once a correct code is submitted, the system establishes a fully authenticated session, effectively bypassing the intended two‑factor requirement. This issue is a CWE‑770 (Excessive Resource Consumption) vulnerability caused by missing rate limiting. Additionally, the API allows administrators to reset other users’ secrets and the application permits disabling two‑factor authentication without OTP re‑verification when the opt‑out flag is set, further weakening security.

This issue affects all installations of Snipe‑IT built before version 8.6.1. The affected vendor is grokability, and the product is the Snipe‑IT asset/license management system. Upgrading to release 8.6.1 or newer incorporates a rate‑limiting guard and fixes the opt‑out bypass. No other versions or vendor releases are known to be impacted.

The CVSS score of 5.9 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation yet. The likely attack vector is remote over HTTP or HTTPS; however, the attacker must first authenticate with valid credentials to launch the brute‑force attack, implying that compromised or privileged accounts are required. Once successful, an attacker gains full access to the system and can further manipulate two‑factor settings for any user.