CVE-2026-103651 in MISP
Summary
by MITRE • 10/01/2026
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter.
The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. The stale cached counter still matches the replayed token, granting a second successful authentication and effectively rewinding the counter state.
Preconditions:
- The target user has HOTP (paper token) second-factor authentication enabled.
- The attacker possesses a valid session in which the password step has already been completed (the OTP step is pending).
- The attacker has access to at least one HOTP token value (e.g., a paper token list).
Security impact:
- Bypass of the second authentication factor, allowing unauthorized access to a user's MISP account.
- Corruption of the HOTP counter state, potentially invalidating subsequent legitimate tokens or enabling further replays.
Affected versions: <2.5.48.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability in question resides within the Multi-Instance Security Platform (MISP) authentication subsystem, specifically targeting the implementation of One-Time Password verification for HOTP-based second-factor authentication. This flaw represents a critical failure in state management and counter synchronization during the multi-step login process. The core technical deficiency lies in how the application handles the sequential validation of credentials. When a user initiates an MFA flow using a paper token, the system first validates the static password component. Upon successful verification of this primary factor, the application establishes or updates a session state that caches specific authentication parameters to facilitate the subsequent step. In this vulnerable implementation, the cached counter value associated with the HOTP algorithm is captured at the moment the initial password check passes and remains static throughout the remainder of the session lifecycle until expiration or explicit logout.
The operational impact of this design flaw allows an attacker who has obtained a valid authenticated session for the primary factor to bypass the second authentication layer entirely through token replay. Because the system compares the submitted HOTP code against the stale, cached counter value rather than querying the authoritative database record that tracks consumed tokens, previously used codes remain valid as long as they fall within the acceptable skew window of the TOTP/HOTP algorithm or match the exact cached index. This effectively neutralizes the security guarantee provided by one-time passwords, which rely on each code being usable only once to prevent replay attacks. An adversary with access to a list of generated HOTP values can simply select and submit any value from that list during the pending OTP verification step, gaining unauthorized full administrative or user-level access to the MISP instance without needing real-time generation capabilities for future tokens.
Beyond immediate account compromise, this vulnerability introduces significant integrity risks regarding the synchronization state between the client-side token generator and the server-side validation logic. By allowing a consumed token to be replayed successfully, the system fails to increment its internal counter record in the database during that specific authentication event if the flow is completed via the cached path without proper backend updates. This desynchronization can lead to corruption of the HOTP counter state for legitimate users. Subsequent authentications by the rightful owner may fail because their generated codes no longer align with the server's expected sequence, or conversely, further replay attacks become easier as the gap between known consumed tokens and accepted values widens unpredictably. This undermines trust in the MFA mechanism entirely, forcing organizations to either disable HOTP authentication or risk persistent unauthorized access vectors that are difficult to detect through standard logging alone since the session appears valid from a server perspective during the flawed verification step.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary fix involves upgrading to MISP version 2.5.48 or later, where this logic has been corrected to ensure that counter validation occurs against the authoritative database state rather than session-cached variables. For environments unable to patch immediately due to operational constraints, temporary mitigations include enforcing stricter session timeouts to reduce the window of opportunity for replay attacks and implementing network-level controls such as rate limiting on authentication endpoints to detect abnormal patterns of token submission attempts. Additionally, organizations should consider transitioning from HOTP paper tokens to time-based OTP (TOTP) solutions or hardware security keys like FIDO2/WebAuthn devices, which are inherently resistant to this specific type of counter-replay vulnerability due to their reliance on synchronized system clocks rather than sequential counters that can be desynchronized by flawed state management.
From a classification perspective, this vulnerability aligns with CWE-347: Improper Verification of Cryptographic Signature, as the application fails to properly verify the integrity and uniqueness of the cryptographic proof provided during authentication. It also maps closely to CWE-290: Authentication Bypass by Spoofing, specifically through session manipulation or state reuse. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK T1078: Valid Accounts, allowing an attacker to leverage stolen credentials and replayed tokens to maintain persistent access without triggering typical anomaly detection systems that monitor for new credential usage rather than reused ones. The lack of proper state synchronization highlights a broader category of issues related to CWE-694: Use of Multiple Resources to Detect Authentication Failures, where the separation of password validation and token validation creates an exploitable gap in the authentication chain if not strictly coupled with consistent backend state updates.