A high-severity authentication bypass vulnerability in Snipe-IT allows attackers to circumvent two-factor authentication and gain administrative control over the application.

This is an authentication bypass vulnerability (CWE-288) caused by inconsistent middleware enforcement where the two-factor authentication check is applied to web sessions but skipped for the API middleware. An attacker with valid credentials and the self.api permission can generate persistent API tokens while still at the two-factor challenge prompt, subsequently using those tokens to reset administrator credentials.

The ability to bypass two-factor authentication and reset administrator credentials poses a critical risk to the confidentiality and integrity of the entire IT asset management system. With a CVSS score of 8.6, this flaw enables unauthorized access to sensitive license data and system configurations, potentially resulting in complete account takeover and long-term persistence within the environment.

Immediate Action: Update the Snipe-IT installation to version 8.7.0 or later immediately to resolve the middleware inconsistency.

Proactive Monitoring: Audit API access logs for anomalous token generation events or unexpected requests to the users/two_factor_reset endpoint, especially from accounts that recently performed login attempts.

Compensating Controls: Restrict access to the Snipe-IT web interface and API endpoints to trusted IP ranges via a Web Application Firewall or VPN until the update is deployed.

Public Exploit Available: Unknown

Given the potential for total administrative account takeover, organizations running Snipe-IT must prioritize the update to version 8.7.0. Verify that all administrative accounts have not had their two-factor settings modified recently and ensure that API usage is strictly governed by the principle of least privilege.