CVE-2026-94379 in MISP
Summary
by MITRE • 09/21/2026
The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:
- the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.
The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.
Version affected: <2.5.47
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in versions of MISP prior to 2.5.47 represents a critical failure in input validation within the UsersController.php login function, specifically concerning HTTP method enforcement. The core technical flaw stems from an insufficient allowlist implementation that only explicitly permitted POST and PUT methods for executing security-critical code paths such as brute-force protection mechanisms, email-based one-time password verification, and login-failure logging. By failing to validate against all other standard HTTP methods like GET or DELETE, the application inadvertently created a bypass vector where unauthenticated attackers could manipulate the request method to circumvent these essential safeguards. This design oversight effectively neutralizes multiple layers of defense simultaneously because the security controls were tightly coupled with specific HTTP verbs rather than being applied universally regardless of the transport mechanism used by the client.
From an operational perspective, this flaw allows an attacker to bypass brute-force mitigation strategies entirely. Since the attempt counter and blocklisting logic are skipped when non-POST or PUT methods are utilized, a malicious actor can perform unlimited credential-guessing attempts without triggering rate limits or account lockouts. This significantly lowers the barrier for successful password attacks, enabling rapid enumeration of valid credentials through automated tools that may default to GET requests or other less common verbs depending on their configuration. The absence of request throttling means that even complex passwords are vulnerable to offline-style attack speeds if the attacker can maintain a steady stream of these malformed requests against the login endpoint.
Furthermore, the vulnerability compromises multi-factor authentication by allowing attackers to skip the email one-time password verification step entirely. In a properly secured environment, MISP requires users to provide both something they know (the password) and something they have (access to their email for the OTP). By exploiting this HTTP method validation gap, an attacker can authenticate using only the static credential, effectively reducing two-factor authentication back to single-factor security. This defeats one of the most effective defenses against compromised passwords, as stolen credentials alone become sufficient for full account takeover without needing access to the victim's secondary communication channel.
The lack of proper logging and audit trail generation further exacerbates the severity of this issue. Login-failure events are not recorded when these bypass methods are used, which removes visibility into ongoing attacks. This absence of telemetry prevents security teams from detecting brute-force campaigns in real-time and eliminates the automated mechanisms that would normally trigger blocklist entries based on failed attempts. Consequently, attackers can operate with a high degree of stealth, making incident response more difficult and allowing prolonged unauthorized access to the MISP instance once credentials are successfully guessed or stolen through other means.
This vulnerability maps directly to CWE-284 Improper Access Control, as it involves an insufficient check for proper authorization before granting access to protected resources. It also aligns with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate account credentials obtained through brute-force or credential stuffing attacks that were not properly mitigated due to the security control bypass. The impact is severe, leading directly to unauthorized access and potential compromise of sensitive threat intelligence data stored within the MISP platform.
To mitigate this risk, organizations running affected versions must upgrade immediately to version 2.5.47 or later where these HTTP method validations have been hardened to enforce strict allowlisting across all security-critical paths regardless of the request verb used. Until an upgrade is possible, administrators should consider implementing web application firewall rules that restrict access to the login endpoint exclusively to POST and PUT methods at the network perimeter level. Additionally, enabling enhanced logging on reverse proxies or load balancers can help monitor for anomalous HTTP method usage patterns targeting authentication endpoints, providing a compensating control to detect exploitation attempts in real-time while maintaining strict audit trails for security operations teams.