Read the docs
TI-2026-63403 Aliases CVE-2026-94379GHSA-3q8c-466v-vgx3

MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

Priority LOW 37CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:   - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked  -  the email OTP two-factor authentication step was skipped, defeating the second factor of authentication  - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00578 47th percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.5.47

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MISPMISPbefore 2.5.472.5.47Patch availableCNA
  • MISP VendorMISP Affected before 2.5.47 Fixed in 2.5.47 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*——Misp-project
  • cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* Versions — — ·Misp-project

Remediation

  • Fix · CNA MISP (MISP) Fixed in 2.5.47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MISP 2.5.47

    11 records Highest priority Priority MEDIUM 2 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2026-63406 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File ExtensionPriority MEDIUM 40
    • TI-2026-63404 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTimePriority MEDIUM 40
    • TI-2026-63419 MISP Arbitrary Local File Read and SSRF via MISP Export UploadPriority LOW 36
    Show all 11 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94379
  2. 2026-10-03 Alias added: GHSA-3q8c-466v-vgx3

References

Patch 1

  • TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
  • TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
  • TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
  • TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
  • TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
  • TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
See all 182 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences