CVE-2026-94379
Deferred Deferred - Pending Action

Authentication Bypass in MISP Login Function

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: CIRCL

Description
The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:   - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked  -  the email OTP two-factor authentication step was skipped, defeating the second factor of authentication  - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94379
EUVD
EUVD-2026-83905

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP's login function allowed attackers to bypass security controls by using HTTP methods other than POST or PUT. The original code only checked for these two methods, skipping bruteforce protection, email OTP verification, and login-failure logging when other methods like GET were used. This effectively disabled multi-factor authentication and rate-limiting protections.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the MISP login endpoint. Look for non-POST/PUT methods (e.g., GET) bypassing security controls. Check logs for repeated failed login attempts without rate-limiting or OTP prompts. Use network tools like tcpdump or Wireshark to inspect HTTP methods targeting /users/login.

Impact Analysis

An attacker could exploit this to bypass brute-force protection, allowing unlimited password guessing attempts. They could also skip the email OTP step, defeating two-factor authentication. Additionally, failed login attempts would not be logged, removing audit trails and preventing account lockouts.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA. The lack of logging for failed attempts also undermines accountability and audit trail requirements mandated by these regulations.

Mitigation Strategies

Upgrade MISP to version 2.5.47 or later. If upgrading is not immediately possible, apply the patch from the GitHub commit ef4dc19c6 to enforce stricter HTTP method validation in UsersController.php. Temporarily disable GET requests to the login endpoint if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart