The vulnerability in Snipe-IT (versions 8.5.0 through 8.6.3) exists in the SAML assertion-consumer endpoint (POST /saml/acs). The endpoint writes the RelayState POST parameter directly into Laravel's url.intended session key after stripping only CR/LF characters. Later, LoginController issues redirect()->intended(), which passes an absolute URL unchanged to the Location header. An attacker can exploit this by sending a crafted IdP-initiated SSO link to a user, causing the user's browser to redirect to an arbitrary external URL immediately after successful authentication. This facilitates credential-harvesting phishing attacks without requiring any account on the target instance or compromise of the identity provider. The vulnerability is fixed in version 8.7.0 by validating RelayState with a same-origin URL check before storing it.

An unauthenticated attacker can induce users of SAML SSO-enabled Snipe-IT instances to be redirected to arbitrary external URLs after authentication. This can be used to facilitate phishing attacks aimed at credential harvesting. There is no need for the attacker to have an account on the target system or to compromise the identity provider. The impact is limited to instances with SAML SSO enabled.

A fix is available in Snipe-IT version 8.7.0, which implements validation of the RelayState parameter using a same-origin URL check before storing it. Users should upgrade to version 8.7.0 or later to remediate this vulnerability. Until upgraded, administrators should consider disabling SAML SSO if feasible or carefully monitor for suspicious SSO links. Patch status is not explicitly stated beyond the fix in 8.7.0; check the vendor advisory for the latest remediation guidance.