Executive brief
MISP is an open-source threat intelligence platform used by organizations to share and analyze cyber threat data. A security flaw in its login system allowed users to be automatically logged into existing accounts based solely on an email address provided by an external identity provider. If that identity provider is not securely configured, an attacker could impersonate a legitimate user and gain full access to their account and sensitive threat data.
Technical details
An authentication bypass vulnerability exists in MISP's OIDC authentication plugin due to improper validation of the 'sub' (subject) claim. The plugin automatically linked OIDC identities to existing local accounts using the email claim if the local account lacked a stored 'sub' value. In environments where the Identity Provider (IdP) is untrusted or insecurely configured (i.e., it does not strictly enforce email ownership), an attacker can present a valid OIDC token with a victim's email address to gain unauthorized access to that user's account. This is classified as Improper Authentication (CWE-287). A fix has been implemented in the MISP repository to address this automatic linking behavior.
Affected products
- MISP Project MISP Prior to commit 71f5662
Timeline
- 2026-05-20: disclosed: CVE-2026-9084 published
- 2026-05-20: patched: Fix committed to MISP repository