Executive brief
MISP, an open-source threat intelligence platform, contained a security flaw that could allow attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker could send them to a legitimate MISP login page and then automatically redirect them to a fraudulent site after they log in. This technique is commonly used in phishing campaigns to steal credentials or deliver malware by exploiting the user's trust in the original MISP domain.
Technical details
An open redirect vulnerability exists in the UsersController::routeafterlogin() function of MISP. The application fails to sufficiently validate the 'pre_login_requested_url' session key, which is used to redirect users back to their intended page after authentication. An attacker can supply a URL containing an external host or protocol-relative paths (e.g., //example.com), which the application treats as a local path. This allows for the construction of phishing links where a victim authenticates to a legitimate MISP instance but is then redirected to an attacker-controlled domain. The issue has been addressed in commit ae760b7 by implementing stricter URL parsing that rejects non-local paths, schemes, and host components.
Affected products
- MISP Project MISP Prior to commit ae760b7
Timeline
- 2026-06-04: advisory: CVE-2026-10861 published by CIRCL
- 2026-06-04: patched: Fix committed to MISP repository