CVE-2026-107276 in MISP
Summary
by MITRE • 10/07/2026
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.
Preconditions:
- The target MISP instance has email OTP login enabled.
- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).
- The attacker can issue two HTTP POST requests in close temporal proximity.
Impact:
- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.
- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.
Affected versions: <2.5.48
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in MISP represents a critical race condition within its email-based one-time password login mechanism, fundamentally undermining the security model of multi-factor authentication. This flaw arises from a lack of atomicity during the validation and consumption phase of the OTP workflow. Specifically, when an HTTP request carrying a valid OTP is processed by the server, the system performs three distinct operations in sequence: it reads the OTP value from the shared storage backend, validates that the code matches the expected hash or plaintext stored for the user, and finally deletes the OTP record to prevent reuse. Because these steps are not executed as a single atomic transaction protected by proper locking mechanisms or database-level constraints, there exists a narrow but exploitable time window between the validation step and the deletion step. During this interval, if an attacker submits two concurrent HTTP POST requests containing the same valid OTP, both requests may pass through the validation logic before either request triggers the deletion of the code from the store. Consequently, the second request finds the OTP still present in the database, validates it successfully, and establishes a separate authenticated session alongside the first one. This behavior directly violates the core principle of one-time passwords, which is that each credential should be usable only once to authenticate a single session.
From an operational perspective, this race condition significantly weakens the authentication controls implemented by MISP administrators who rely on email OTP as their primary or secondary factor for securing access to sensitive threat intelligence data. The impact extends beyond simple account takeover; it introduces ambiguity into audit logs and security monitoring systems because multiple sessions can be established from a single authentication event using the same credential. If an attacker intercepts an OTP via man-in-the-middle attacks, social engineering, or compromised email accounts, they are no longer limited to a single login attempt per code. By leveraging concurrent requests through automated tools or specialized scripts, the attacker can reliably bypass the one-time restriction and gain persistent access to the MISP instance. This is particularly dangerous in environments where high-value threat intelligence is stored, as unauthorized access could lead to data exfiltration, manipulation of indicators of compromise, or poisoning of shared feeds with malicious data that affects downstream consumers of the platform.
The technical classification of this vulnerability aligns closely with CWE-362, which describes concurrent execution using shared resources with improper synchronization. In this context, the OTP record in the database serves as the shared resource, and the lack of atomic read-validate-delete operations constitutes an improper synchronization mechanism that allows race conditions to occur. Furthermore, from a threat actor perspective, this flaw facilitates Initial Access through compromised credentials or intercepted authentication tokens, mapping to MITRE ATT&CK technique T1078, specifically Valid Accounts. The ability to reuse a single-time password effectively downgrades the security posture of MISP instances running versions prior to 2.5.48 from multi-factor strength to something resembling static credential protection with an added delay rather than true one-time enforcement.
To mitigate this vulnerability and prevent similar race conditions in authentication flows, it is essential to implement atomic operations at both the application logic level and the database layer. The most robust solution involves using database-level transactions that lock the OTP record during validation, ensuring that no other process can read or modify the record until the current transaction commits or rolls back. Alternatively, implementing a compare-and-swap operation ensures that the deletion of the OTP only succeeds if its value has not changed since it was last read, thereby rejecting subsequent requests for the same code even if they arrive concurrently. For organizations currently running affected versions below 2.5.48, immediate upgrading to the patched version is required to resolve this logic flaw. In addition to patching, administrators should consider implementing rate limiting on login endpoints and monitoring for unusual patterns of concurrent authentication attempts from single IP addresses or user accounts as a compensating control while updates are being applied.