Improper Handling of Case Sensitivity in snipe-it - #VU145110
Published: August 25, 2026
Vulnerability details
The vulnerability allows a remote user to take over another user\'s account.
The vulnerability exists due to improper handling of case sensitivity in the SAML login username lookup in app/Services/Saml.php when processing a signed SAML assertion and resolving the username against users.username using a collation-folded equality query. A remote user can supply a username that is an accent or case variant of a victim\'s username to take over another user\'s account.
The issue occurs on MySQL or MariaDB installations where the users.username column uses the default utf8mb4_unicode_ci collation, and the same lookup pattern also affected other federated login paths including LDAP, REMOTE_USER, and Google OAuth.