CVE-2026-85237 in MISP
Summary
by MITRE • 09/03/2026
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts.
The email_otp() endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP verification stage, for example after successfully providing a user's primary authentication credentials, could repeatedly submit candidate OTP values while the same OTP remained valid. This significantly increased the feasibility of guessing the OTP and bypassing the additional authentication factor, potentially resulting in unauthorized access to the affected user's account.
The issue was exacerbated by the fact that the OTP is associated with the user rather than with an individual pending login session, allowing multiple concurrent sessions to attempt guesses against the same valid OTP.
The patch integrates the existing MISP brute-force protection mechanism into the email OTP flow. Failed OTP attempts are now counted against the user, further attempts are rejected once the configured threshold is reached, and the active OTP is invalidated when the attempt budget is exhausted. Blocklisted users are also prevented from requesting the generation of a fresh OTP. In addition, OTP comparison now uses hash_equals() and validates that the submitted value is a string.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in MISP involves a critical flaw within its email-based one-time password authentication flow, specifically affecting the integrity of multi-factor authentication mechanisms. This security issue stems from the absence of brute-force protection on the endpoint responsible for validating OTP values. In a properly secured system, rate limiting and account lockout policies are essential to prevent automated guessing attacks against transient credentials. However, in this specific implementation, the email_otp() function did not enforce any such restrictions during the verification process. This architectural oversight allowed an attacker who had already compromised or obtained valid primary authentication credentials for a user to bypass the second factor of security through exhaustive trial and error. The lack of throttling meant that there was no technical barrier preventing repeated submissions of different OTP codes until one matched, effectively reducing the entropy-based security of the one-time password to a trivial guessing game rather than a robust verification step.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality and integrity of user accounts within the MISP platform. An attacker leveraging this flaw could perform an unrestricted number of OTP verification attempts while the current code remains valid. Given that many one-time passwords are short numeric strings with limited entropy, a brute-force attack can succeed in a very short timeframe using automated scripts. This significantly increases the feasibility of bypassing the additional authentication factor, leading to unauthorized access to sensitive threat intelligence data and user profiles associated with the compromised account. The severity is further exacerbated by the design choice where the OTP is associated with the user identity rather than an individual pending login session. Consequently, multiple concurrent sessions could attempt guesses against the same valid OTP simultaneously, amplifying the attack surface and allowing parallelized brute-force attempts that would be impossible if each session had its own isolated token lifecycle.
To remediate this vulnerability, the patch integrates existing MISP brute-force protection mechanisms directly into the email OTP flow, ensuring consistent security policies across all authentication stages. The updated implementation counts failed OTP attempts against the specific user account rather than ignoring them or limiting them per-session only. Once a configurable threshold of incorrect attempts is reached, further verification requests are rejected, and the active OTP is immediately invalidated to prevent continued guessing. Additionally, users who have been blocklisted due to suspicious activity are prevented from requesting the generation of fresh OTPs, thereby closing the loop on potential denial-of-service or persistent brute-force attacks. These changes align with industry best practices for account security and mitigate the risk of credential stuffing and automated guessing attacks by enforcing strict limits on authentication attempts.
From a technical implementation perspective, the patch also addresses common coding vulnerabilities related to timing attacks and type confusion. The OTP comparison logic now utilizes hash_equals(), which performs constant-time string comparisons to prevent attackers from deducing valid codes based on response time differences. This is a critical defense against timing side-channel attacks often employed in conjunction with brute-force strategies. Furthermore, the validation process ensures that the submitted value is strictly treated as a string before comparison, preventing potential type juggling vulnerabilities that could arise if numeric inputs were loosely compared to alphanumeric OTPs. These enhancements collectively strengthen the authentication layer and reduce the attack surface associated with multi-factor authentication systems.
In terms of industry standards, this vulnerability corresponds closely to CWE-307, which describes Improper Restriction of Excessive Authentication Attempts. The failure to limit login attempts is a classic example of this weakness, allowing attackers to bypass access controls through brute force. Additionally, the exploitation technique aligns with MITRE ATT&CK techniques such as T1110.001, known as Brute Force: Password Guessing, and potentially T1621, Multi-Factor Authentication Request Interception or Bypass if the attacker can intercept or manipulate the OTP delivery channel, though in this case, the bypass is purely computational due to the lack of rate limiting. The remediation efforts reflect adherence to NIST guidelines on authentication security, which emphasize the necessity of implementing account lockout mechanisms and using secure comparison functions for sensitive data like one-time passwords. Organizations running MISP must ensure they apply these patches promptly to maintain the integrity of their threat intelligence sharing operations and protect against unauthorized access via compromised credentials.