CVE-2026-86770 describes a vulnerability in Snipe-IT before version 8.7.0 where the application fails to properly validate username case sensitivity during SAML authentication. Due to the default utf8mb4_unicode_ci collation in the database, attackers can register identity provider accounts with accented or case-variant usernames that bypass the username matching logic. This allows attackers to authenticate as other users through federated login paths including SAML, LDAP, and OAuth, resulting in account takeover risks.

Attackers can exploit this vulnerability to bypass username matching and authenticate as other users by registering IdP accounts with case or accent variations of victim usernames. This leads to potential account takeover via federated login mechanisms, compromising user accounts and associated privileges within Snipe-IT.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates and consider restricting federated login methods or implementing additional username validation controls as interim mitigations.