CVE-2026-103655 in MISP
Summary
by MITRE • 10/01/2026
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window.
The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.
Preconditions:
- The target user has TOTP-based two-factor authentication enabled.
- The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client).
- The replay must occur within the TOTP validity period.
Security impact:
- Unauthorized account access by replaying a captured one-time code.
- Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user.
Affected versions: <v2.5.48.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability in MISP, specifically within its two-factor authentication implementation for Time-based One-Time Passwords or TOTP, represents a critical failure in session management and state tracking during the login process. While TOTP is designed to provide dynamic credentials that change at regular intervals, typically every thirty seconds, this flaw allows a single generated code to be accepted multiple times if it falls within the same validity window. The core technical deficiency lies in the absence of a mechanism to track or record whether a specific time period's token has already been successfully utilized for authentication. In a secure implementation, once a TOTP code is validated and grants access, the system must immediately invalidate that specific instance of the code to prevent reuse. However, because MISP failed to maintain this state, any valid code generated during a thirty-second interval remained active until that window expired or was manually invalidated by other means, creating a significant replay attack surface.
This architectural oversight directly enables unauthorized account access through credential replay attacks. An attacker who successfully intercepts a legitimate TOTP code can exploit the lack of consumption tracking to authenticate into multiple sessions simultaneously as the targeted user. The preconditions for this exploitation are relatively straightforward and align with common threat vectors in network security environments. If an adversary is positioned to observe or capture the one-time password during a victim's login attempt, they do not need to wait for the code to expire before attempting reuse. This could occur through various methods such as man-in-the-middle attacks on unencrypted connections, shoulder surfing if physical access is possible, or exploitation of compromised client-side applications that log authentication data. The critical constraint remains temporal; the replay must occur within the thirty-second validity window of the captured token, but this narrow timeframe is often sufficient for automated tools to execute multiple login attempts rapidly.
The security impact of this vulnerability extends beyond simple unauthorized access to potentially severe compromises of threat intelligence integrity and administrative control. MISP serves as a central hub for sharing cyber threat indicators among organizations, meaning that an attacker gaining authenticated access can exfiltrate sensitive data regarding ongoing investigations, malware samples, or network configurations belonging to the compromised user. Furthermore, if the targeted account possesses administrative privileges, the attacker could manipulate platform settings, disable security controls, or inject false intelligence into the shared database, thereby undermining trust in the entire threat-sharing ecosystem. This risk is particularly acute given that many organizations rely on MISP for critical incident response and proactive defense strategies, making such a breach not just an individual account compromise but a potential systemic failure of organizational cybersecurity posture.
To mitigate this vulnerability, immediate action must be taken by upgrading to version 2.5.48 or later where the issue has been resolved through proper state management in the authentication flow. For environments that cannot immediately upgrade, administrators should enforce additional layers of security such as requiring IP-based restrictions for administrative logins or implementing network-level protections like TLS inspection and intrusion detection systems capable of identifying rapid successive login attempts from a single source. Additionally, organizations should review their logging practices to ensure that failed and successful authentication events are monitored closely, allowing for the detection of replay patterns even if the underlying TOTP flaw persists in older versions. This incident highlights the importance of adhering strictly to industry standards such as CWE-294 which addresses authentication bypass by capture-replay attacks, ensuring that stateful validation is always implemented alongside cryptographic verification mechanisms.