CVE-2026-90961 in MISP
Summary
by MITRE • 09/14/2026
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings.
In the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes.
In the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string.
A secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access.
The vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data.
Version affected: ≤2.5.45
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The LdapAuth and LinOTPAuth authentication plugins within the MISP platform contain a critical authentication bypass vulnerability stemming from an incomplete implementation of input validation logic. These custom authenticators were designed to replace CakePHP's standard FormAuthenticate class but failed to replicate its _checkFields() method, which serves as a primary guard against empty or malformed credentials. Consequently, when users attempt to log in via these plugins, the system extracts email and password fields from the login request without verifying that they are non-empty strings. This omission allows attackers to bypass authentication mechanisms by submitting requests with null, empty, or otherwise invalid credential values, effectively circumventing the intended security controls designed to ensure only valid credentials grant access.
In the context of the LDAP authenticator, this flaw has severe implications due to how directory services handle bind operations. When an attacker provides a known valid user email address along with an empty or null password, the system forwards these parameters directly to ldap_bind(). According to RFC 4513 section 5.1.2, a bind request containing a distinguished name and an empty password constitutes an unauthenticated bind. Many LDAP directory servers interpret this as a successful authentication attempt, allowing the attacker to log in as that user without possessing their actual secret credentials. Furthermore, non-string values such as null, false, or arrays are either coerced into empty strings by ldap_bind(), cause TypeErrors, or are misinterpreted as database find conditions within _findUser(). These edge cases further expand the attack surface, leading to unintended authentication outcomes where invalid inputs result in successful logins rather than rejection.
The LinOTP authenticator exhibits similar weaknesses due to the same missing validation guard. Here, non-string credentials are concatenated into the verification request sent to the LinOTP service. In scenarios involving mixed-authentication fallbacks, an empty password is accepted against a stored hash of the empty string. This behavior permits attackers who know valid user identifiers to authenticate successfully by exploiting the system's tolerance for empty credential inputs. The lack of strict type checking and length validation means that malformed or intentionally crafted payloads can bypass security checks intended to enforce strong authentication practices.
A secondary but equally dangerous issue exists within the LDAP authenticator regarding newly created user accounts through auto-provisioning on first login. When a new account is provisioned, it is assigned an empty password because the save path skips standard validation routines. This empty string is then hashed and stored in the database. If such a user subsequently ceases to exist or become reachable within the LDAP directory, the system may fall back to local authentication methods using mixed-authentication logic. In this fallback scenario, the stored hash of the empty string verifies successfully against an empty password provided by an attacker. This creates a persistent vulnerability where previously provisioned accounts can be accessed without any valid credentials if their external identity is no longer verifiable through LDAP.
Exploitation of these vulnerabilities requires that either the LdapAuth or LinOTPAuth plugin is enabled on the targeted MISP instance and that the attacker possesses knowledge of at least one valid email address registered in the directory or user store. No prior authentication session or credentials are required to initiate an attack, making this a significant risk for organizations relying on external identity providers. Successful exploitation grants the attacker full privileges associated with the impersonated user account. Given MISP's role as a threat intelligence sharing platform, these accounts often possess administrative capabilities, allowing attackers to view, modify, or exfiltrate sensitive security data and compromise the integrity of shared indicators.
This vulnerability aligns with CWE-287 Improper Authentication, specifically reflecting failures in validating input parameters before processing them through authentication logic. It also maps to ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials or exploit weaknesses in credential validation to gain unauthorized access. To mitigate this risk, organizations should immediately upgrade MISP to version 2.5.46 or later, which addresses these input validation gaps by enforcing strict checks on email and password fields before they are passed to downstream authentication services. Additionally, administrators should review auto-provisioned accounts for any that may have been assigned empty passwords due to the previous save path behavior and enforce strong password policies across all user types.