CVE-2026-49870
1 advisory.
Packagist/snipe/snipe-it CVE-2026-49870: medium 5.9
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Action: Upgrade snipe/snipe-it to 8.6.0 or later.
composer require snipe/snipe-it:8.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 8.6.0 | - |
Fixed versions
| 8.6.0 |
Sources
- osv: GHSA-mr8g-2mj4-pcq2
- https://github.com/grokability/snipe-it/security/advisories/GHSA-mr8g-2mj4-pcq2
- https://github.com/grokability/snipe-it
CVE-2026-49870 · published · modified · JSON