Executive brief
MISP, a popular threat intelligence sharing platform, had a weakness in its email-based multi-factor authentication that allowed attackers to guess one-time passwords (OTPs) without limit. An attacker who had already compromised a user's primary login credentials could repeatedly try OTP combinations until gaining account access, effectively bypassing the secondary authentication layer. This put sensitive threat intelligence and organizational security data at risk of unauthorized access.
Technical details
The email_otp() endpoint in MISP lacked rate-limiting or brute-force protection on OTP verification attempts. An attacker in possession of valid primary credentials could submit unlimited OTP guesses against the same valid code. The vulnerability was further amplified because the OTP was tied to the user account rather than individual login sessions, permitting concurrent sessions to attempt guesses against the same OTP. The patch applies MISP's existing brute-force protection mechanism: failed OTP attempts are now throttled, the OTP is invalidated after the attempt threshold is exceeded, and hash_equals() is used for constant-time comparison.
Affected products
- MISP MISP <UNKNOWN>
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fix applied in commit 8658062