Executive brief
MISP, a popular open-source threat intelligence platform, contains a security flaw that allows users to bypass multi-factor authentication (MFA). In specific configurations using LDAP for login, an attacker with a valid password could skip the required one-time password (OTP) step and gain full access to the platform. This could lead to the unauthorized exposure of sensitive threat data and organizational intelligence.
Technical details
An authentication bypass vulnerability (CWE-287) exists in MISP when 'LdapAuth.mixedAuth' is enabled and 'Security.require_otp' is set to true. The vulnerability occurs because the application's 'beforeFilter' phase establishes a valid user session for plugin-backed authentications (like LDAP) before the standard login flow can enforce the OTP challenge. An attacker with valid primary credentials can bypass the MFA requirement by authenticating via the plugin and then navigating directly to other application URLs instead of the OTP verification page. A fix has been implemented in the AppController to ensure OTP requirements are validated immediately after plugin authentication.
Affected products
- MISP Project MISP All versions prior to commit 39b3cb1
Timeline
- 2026-06-02: advisory: NVD publication date
- 2026-06-02: patched: Fix committed to MISP repository