CVE-2026-85238
Undergoing Analysis Undergoing Analysis - In Progress

Session Fixation in MISP CustomAuth Authentication

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: CIRCL

Description
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim's authenticated MISP session, potentially gaining the privileges associated with the victim's account. The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session->renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85238
EUVD
EUVD-2026-70532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 5a6e4751-2f3f-4070-9419-94fb35b644e8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a session fixation vulnerability in its CustomAuth authentication flow. When a user logs in via CustomAuth, the system stores the user's identity in the existing session without changing the session ID. This allows attackers who know the session ID before authentication to reuse it after the victim logs in, gaining access to the victim's account.

Detection Guidance

To detect this vulnerability, monitor for unusual session behavior in MISP logs. Check if session identifiers remain unchanged after authentication events. Look for multiple users sharing the same session ID or unexpected session persistence.

Impact Analysis

If you use MISP with CustomAuth, an attacker could hijack your session by tricking you into using a session ID they know. They could then access your account, view or modify sensitive data, or perform actions with your privileges without needing your credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using MISP with CustomAuth may fail compliance audits if this issue is not addressed.

Mitigation Strategies

Apply the official patch from MISP's GitHub commit e2eb2f058. Ensure session rotation occurs during authentication events. Disable CustomAuth if not required. Monitor sessions for anomalies after applying fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart