CVE-2026-85216 in MISP
Summary
by MITRE • 09/03/2026
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials.
The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate its credential validation checks. As a result, empty or non-string values could reach the underlying authentication mechanisms.
In the LDAP authentication path, an attacker able to identify a valid directory user's email address could submit an empty password. The empty credential could be passed to ldap_bind(), where an LDAP server accepting unauthenticated binds may return a successful result for a valid distinguished name combined with an empty password. MISP could consequently treat the attacker as the corresponding authenticated directory user without verification of the user's password.
The issue also affected the LinOTP authentication component. Invalid credential types were not rejected before being processed, and when mixed authentication was enabled, an empty password could be checked against a locally stored MISP password hash. LDAP-provisioned MISP accounts could additionally be created with an empty local password because account creation skipped normal validation, resulting in a hash corresponding to an empty password. This could permit authentication through the local fallback mechanism when such an account was no longer resolved through LDAP.
Successful exploitation could allow a remote unauthenticated attacker to impersonate an existing MISP user. If the targeted account has administrative or other privileged permissions, the attacker could gain corresponding access to sensitive threat-intelligence data, modify or delete information, alter configuration, or perform other privileged operations.
The patch resolves the vulnerability by requiring authentication identifiers and passwords to be valid strings, rejecting empty passwords where they are not explicitly permitted, and assigning a randomly generated local password to LDAP-provisioned accounts instead of storing a hash derived from an empty password.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The identified security flaw resides within the custom authentication components for Lightweight Directory Access Protocol (LDAP) and LinOTP in the MISP platform, specifically stemming from insufficient validation of user-supplied credentials during the login process. These custom implementations, designated as LdapAuthenticate and LinOTPAuthenticate, were designed to replace the standard CakePHP FormAuthenticate mechanism but failed to replicate its rigorous credential validation checks. This architectural oversight allows empty or non-string values to bypass initial screening and reach the underlying authentication logic, creating a critical gap in access control that undermines the integrity of user identity verification.
In the context of LDAP authentication, this vulnerability enables an attacker who has identified a valid directory user's email address to perform an unauthenticated bind attack by submitting an empty password field. When these credentials are passed to the ldap_bind function, many LDAP servers configured to accept unauthenticated binds will return a successful result if provided with a valid distinguished name and an empty password string. Consequently, MISP incorrectly interprets this success as proof of authentication, granting the attacker access as the targeted directory user without ever verifying their actual secret credentials. This behavior exploits the default security posture of many LDAP servers which allow anonymous or unauthenticated binds for basic information retrieval, inadvertently extending that trust to application-level login mechanisms where it is not warranted.
The vulnerability also extends to the LinOTP authentication component and local fallback mechanisms when mixed authentication modes are enabled. The system fails to reject invalid credential types before processing them, allowing empty passwords to be checked against locally stored MISP password hashes. Furthermore, during account creation for LDAP-provisioned users, the platform skips normal validation procedures, resulting in accounts being created with an empty local password hash. This creates a persistent backdoor where if an LDAP connection fails or is unavailable, and the system falls back to local authentication, any user associated with such an improperly provisioned account can log in using no credentials at all, effectively bypassing both external directory controls and internal password policies.
Successful exploitation of this vulnerability allows remote unauthenticated attackers to impersonate existing MISP users without prior knowledge of their passwords. If the targeted account possesses administrative privileges or other elevated permissions, the impact is severe, enabling the attacker to gain unauthorized access to sensitive threat intelligence data, modify or delete critical information, alter system configurations, and perform other privileged operations that compromise the confidentiality, integrity, and availability of the platform's security functions. This aligns with CWE-287 Improper Authentication, as the software does not adequately verify credentials before granting access, and maps to MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate user accounts to maintain persistence or escalate privileges within a compromised environment.
The remediation strategy implemented in the patch addresses these flaws by enforcing strict type checking on authentication identifiers and passwords, ensuring they are valid strings rather than empty values. The solution explicitly rejects empty passwords unless such access is intentionally permitted through specific configuration settings that require additional security controls. Additionally, for LDAP-provisioned accounts, the system now assigns a randomly generated local password instead of storing a hash derived from an empty string. This ensures that even if fallback authentication occurs, there are no default credentials with zero entropy that can be exploited by attackers seeking to bypass identity verification mechanisms and gain unauthorized access to the MISP instance.