OAuth Client Management Vulnerability in Snipe-IT by Grokability

CVE-2026-86754

What is CVE-2026-86754?

Snipe-IT versions prior to 8.7.0 have a security flaw that allows authenticated users to manipulate OAuth client management routes improperly. This loophole could enable an attacker to register OAuth clients using malicious redirect URIs. Once approved by an administrator, the attacker can exploit consent screens to obtain authorization codes, which can then be exchanged for bearer tokens. These tokens grant full administrative API access and can remain active for an extensive duration, potentially leading to significant security breaches within the affected system.

References