CVE-2026-86754 is an incorrect authorization vulnerability in Snipe-IT before version 8.7.0. The application fails to properly restrict access to Laravel Passport's OAuth client management routes, allowing any authenticated user to create OAuth clients with redirect URIs controlled by an attacker. This can lead to attackers deceiving administrators into consenting to OAuth authorization screens, after which the attacker can exchange authorization codes for bearer tokens that grant full administrative API access with a very long validity period.

An attacker with any authenticated user privileges can register malicious OAuth clients and trick administrators into granting consent. This results in the attacker obtaining bearer tokens with full administrative API permissions, potentially compromising the entire system. The tokens can remain valid for up to 40 years, significantly increasing the risk and duration of unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to OAuth client management routes if possible, and monitor for suspicious OAuth client registrations and consent approvals.