MISP up to 2.5.38 Authentication Plugin improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in MISP up to 2.5.38. Affected is an unknown function of the component Authentication Plugin Handler. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2026-10611. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in MISP up to 2.5.38. This issue affects an unknown functionality of the component Authentication Plugin Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality. The summary by CVE is:

An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established during the application beforeFilter phase before the normal login flow enforces the OTP challenge. As a result, an attacker with valid primary authentication credentials could bypass the required OTP step by authenticating through the plugin-backed login flow and then directly accessing another application URL instead of completing the OTP verification page. This allows access to the application as the affected user without providing a valid TOTP, HOTP, or email OTP code. The issue affects configurations where plugin-based authentication is enabled and OTP is expected to be mandatory. The fix ensures that OTP requirements are checked immediately after plugin authentication and before the user session is established, redirecting users to the appropriate OTP challenge when required.

The weakness was shared by Andrea Capelli as 39b3cb15aac4318afdd2ab63b96c2eac12b271fe. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-10611 since 06/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Applying the patch 39b3cb15aac4318afdd2ab63b96c2eac12b271fe is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1778). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Open Source MISP

Productinfo

Name

• MISP

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 2.5.32
• 2.5.33
• 2.5.34
• 2.5.35
• 2.5.36
• 2.5.37
• 2.5.38

License

• open-source

Website

• Product: https://github.com/MISP/MISP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion