# CVE-2026-103651: MISP HOTP token replay via cached counter

Source: https://junglewise.ai/threats/cve-2026-103651-misp-contains-a-vulnerability-in-its-one-time-password-otp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103651 · Severity: info · Published 2026-10-01

MISP is an open-source threat intelligence platform that uses two-factor authentication to protect user accounts. A vulnerability in the paper token (HOTP) authentication logic allows an attacker with access to an active user session to replay previously used authentication tokens, bypassing the second factor and gaining unauthorized access to the account.

Technologies: [MISP Project MISP](https://junglewise.ai/threats/technologies/misp-project-misp). Vendors: [MISP Project](https://junglewise.ai/threats/vendors/misp-project).

## Quick answers

**Is CVE-2026-103651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103651 being exploited in the wild.

**How severe is CVE-2026-103651?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** MISP Project MISP before 2.5.48.

**Is there a fix for CVE-2026-103651?** Yes: fixed in 2.5.48. Until then: Disable HOTP (paper token) second-factor authentication for users whose accounts cannot be upgraded immediately, and require users to change their passwords and revoke any potentially compromised sessions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103651 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103651?** Check whether you run MISP Project MISP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.48

Disable HOTP (paper token) second-factor authentication for users whose accounts cannot be upgraded immediately, and require users to change their passwords and revoke any potentially compromised sessions.

## Technical details

The HOTP verification logic compares submitted tokens against a counter value cached in the user's session at password entry time, rather than the authoritative counter in the database. Because the cached counter is never updated after a token is consumed, an attacker with a valid session (password already submitted, OTP step pending) can reuse a burned HOTP token; the stale cached counter still matches, granting a second authentication and rewinding the token counter. This requires both an active session and knowledge of a previously-used token.

## Affected products

- MISP Project MISP before 2.5.48

## Timeline

- 2026-10-01: disclosed

## References

- [https://github.com/MISP/MISP/commit/f34aee2c7](https://github.com/MISP/MISP/commit/f34aee2c7)

## Related threats

- [MISP module plugin settings flags not preserved](https://junglewise.ai/threats/cve-2026-112192-misp-contains-a-vulnerability-in-the-handling-of-module-plugin)
- [MISP server settings information disclosure](https://junglewise.ai/threats/cve-2026-112188-misp-contains-a-vulnerability-in-its-server-settings-lookup)
- [MISP reflected XSS in workflow module interface](https://junglewise.ai/threats/cve-2026-112184-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)
- [MISP data integrity flaw in event deletion logic](https://junglewise.ai/threats/cve-2026-112180-misp-contains-a-data-integrity-flaw-in-its-event-deletion-logic)
- [MISP event synchronization information disclosure via tag filtering](https://junglewise.ai/threats/cve-2026-112179-in-misp-the-event-synchronization-process-contained-a-logic)