In short
- CVE-2026-44833 is a HIGH (CVSS 7.1) vulnerability affecting snipe/snipe-it, snipe-it (snipeitapp).
- Chance of exploitation in the next 30 days (EPSS): 0.16%, higher than 5.5% of all vulnerabilities.
- Fix: update to 8.4.1 or later.
Description
Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.
Impact
- Phishing: Redirect users to fake login pages to steal credentials
- Session Hijacking: Redirect to attacker site that captures session cookies via JavaScript
- Malware Distribution: Redirect to sites hosting malware or drive-by downloads
- Reputation Damage: Users lose trust when redirected to malicious sites from legitimate application
- Social Engineering: Use trusted Snipe-IT domain to increase phishing success rate
When the user clicks "Save", the application:
- Processes the form
- Checks
redirect_option (if set to 'back')
- Calls
Helper::getRedirectOption()
- Retrieves
back_url from session: https://evil.com/phishing?target=snipeit
- Executes
redirect()->to($backUrl)
- User is redirected to attacker's site
This would still require session poisoning, so the actual practical threat here is minimal.
Patches
Patched in https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373, released in 8.4.1.
Workarounds
None.
Resources
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- OWASP: Unvalidated Redirects and Forwards
- Laravel Security: Safe Redirects
snipeit_open_redirect_submission.md
NVD description
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.
More vulnerabilities in snipe/snipe-it
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free