# CVE-2026-85238: MISP session fixation vulnerability in CustomAuth

Source: https://junglewise.ai/threats/cve-2026-85238-misp-session-fixation-vulnerability-in-customauth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85238 · Severity: medium · CVSS 6.8 · Published 2026-09-03

MISP is an open-source threat intelligence sharing platform used by organizations to collaborate on security incidents and malware analysis. A session fixation flaw in the CustomAuth authentication method allows an attacker who knows a victim's session identifier before login to reuse that same identifier after the victim authenticates, gaining unauthorized access to the victim's account and privileges.

Technologies: [Misp](https://junglewise.ai/threats/technologies/misp). Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-85238 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85238 being exploited in the wild.

**How severe is CVE-2026-85238?** Medium severity, with a CVSS score of 6.8, published 3 September 2026.

**Which products and versions are affected?** Misp <UNKNOWN>.

**Is there a fix for CVE-2026-85238?** A patch was published on 2026-09-03: Commit e2eb2f0 restores session rotation on CustomAuth authentication Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85238 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85238?** Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a session fixation vulnerability in MISP's CustomAuth authentication flow. The root cause is that the __customAuthentication() function stores the authenticated user identity in the existing CakePHP session without rotating the session identifier, as the call to Session->renew() was previously disabled. An attacker can force a victim to use a known session identifier before authentication; after successful authentication through CustomAuth, that same identifier remains valid and can be reused by the attacker. The attack is network-accessible and requires no victim interaction beyond normal authentication. The patch restores session identifier rotation on new authentication or when the authenticated user changes, while avoiding unnecessary renewal on every request.

## Affected products

- MISP MISP <UNKNOWN>

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched: Commit e2eb2f0 restores session rotation on CustomAuth authentication

## References

- [https://github.com/MISP/MISP/commit/e2eb2f058](https://github.com/MISP/MISP/commit/e2eb2f058)

## Related threats

- [MISP CSS injection in remote event preview](https://junglewise.ai/threats/cve-2026-112183-misp-contains-a-css-injection-vulnerability-in-the-remote-event)
- [MISP access control flaw in proposal visibility logic](https://junglewise.ai/threats/cve-2026-112178-misp-contains-an-access-control-flaw-in-the-proposal-shadow)
- [MISP authorization flaw in correlation handling](https://junglewise.ai/threats/cve-2026-104912-misp-contains-an-authorization-flaw-in-its-correlation-handling)
- [MISP improper input validation in decaying model import](https://junglewise.ai/threats/cve-2026-104908-misp-contains-an-improper-input-validation-vulnerability-in-the)
- [MISP reflected XSS in taxonomy tag confirmation forms](https://junglewise.ai/threats/cve-2026-103662-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)