# CVE-2026-103655: MISP TOTP verification code reuse vulnerability

Source: https://junglewise.ai/threats/cve-2026-103655-misp-contains-a-vulnerability-in-its-two-factor-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103655 · Severity: info · Published 2026-10-01

MISP is a threat intelligence platform used to share and manage threat data across organizations. The platform's two-factor authentication system has a vulnerability that allows attackers to replay captured one-time codes to gain unauthorized access to user accounts. An attacker who intercepts a legitimate authentication code during someone's login could reuse that same code within its 30-second validity window to compromise that account.

Technologies: [Misp](https://junglewise.ai/threats/technologies/misp). Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-103655 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103655 being exploited in the wild.

**How severe is CVE-2026-103655?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** Misp < 2.5.48.

**Is there a fix for CVE-2026-103655?** Yes: fixed in 2.5.48 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103655 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103655?** Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.48 and later

## Technical details

The vulnerability exists in the TOTP verification logic within MISP's user login flow, where the system fails to record whether a given TOTP time period has been consumed. This allows the same valid code to be accepted multiple times within its validity window. An attacker must intercept a legitimate TOTP code (via network interception, shoulder surfing, or compromised client) and replay it within the code's validity period; the attack requires the target user to have TOTP enabled.

## Affected products

- MISP MISP < 2.5.48

## Timeline

- 2026-10-01: disclosed

## References

- [https://github.com/MISP/MISP/commit/a020fa47b](https://github.com/MISP/MISP/commit/a020fa47b)

## Related threats

- [MISP CSS injection in remote event preview](https://junglewise.ai/threats/cve-2026-112183-misp-contains-a-css-injection-vulnerability-in-the-remote-event)
- [MISP access control flaw in proposal visibility logic](https://junglewise.ai/threats/cve-2026-112178-misp-contains-an-access-control-flaw-in-the-proposal-shadow)
- [MISP authorization flaw in correlation handling](https://junglewise.ai/threats/cve-2026-104912-misp-contains-an-authorization-flaw-in-its-correlation-handling)
- [MISP improper input validation in decaying model import](https://junglewise.ai/threats/cve-2026-104908-misp-contains-an-improper-input-validation-vulnerability-in-the)
- [MISP reflected XSS in taxonomy tag confirmation forms](https://junglewise.ai/threats/cve-2026-103662-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)