MISP up to 2.5.37 OIDC Authentication Plugin improper authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in MISP up to 2.5.37. The affected element is an unknown function of the component OIDC Authentication Plugin. Such manipulation leads to improper authentication. This vulnerability is listed as CVE-2026-9084. The attack must be carried out from within the local network. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in MISP up to 2.5.37. Affected by this issue is some unknown functionality of the component OIDC Authentication Plugin. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality. CVE summarizes:

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

The weakness was presented by Ali Ganiyev as 71f5662c1b5886613d2cd5c72fd93bb4ca6fa172. The advisory is available at github.com. This vulnerability is handled as CVE-2026-9084 since 05/20/2026. The exploitation is known to be difficult. The attack can only be initiated within the local network. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 2.5.38 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 71f5662c1b5886613d2cd5c72fd93bb4ca6fa172 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1631). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source MISP

Productinfo

Name

• MISP

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 2.5.32
• 2.5.33
• 2.5.34
• 2.5.35
• 2.5.36
• 2.5.37

License

• open-source

Website

• Product: https://github.com/MISP/MISP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion