Executive brief
MISP is an open-source threat intelligence sharing platform used by organizations to collaborate on security incidents and malware analysis. A session fixation flaw in the CustomAuth authentication method allows an attacker who knows a victim's session identifier before login to reuse that same identifier after the victim authenticates, gaining unauthorized access to the victim's account and privileges.
Technical details
This is a session fixation vulnerability in MISP's CustomAuth authentication flow. The root cause is that the __customAuthentication() function stores the authenticated user identity in the existing CakePHP session without rotating the session identifier, as the call to Session->renew() was previously disabled. An attacker can force a victim to use a known session identifier before authentication; after successful authentication through CustomAuth, that same identifier remains valid and can be reused by the attacker. The attack is network-accessible and requires no victim interaction beyond normal authentication. The patch restores session identifier rotation on new authentication or when the authenticated user changes, while avoiding unnecessary renewal on every request.
Affected products
- MISP MISP <UNKNOWN>
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Commit e2eb2f0 restores session rotation on CustomAuth authentication