Executive brief
MISP, a threat intelligence platform, had a flaw in its two-factor authentication (TOTP) login flow where disabled user accounts were not properly rejected. Instead of being denied access immediately, a disabled user enrolled in TOTP would be asked to enter their second factor, disclosing that the account exists. While subsequent checks still prevented actual account access, this creates a minor information leak and generates spurious warnings in application logs.
Technical details
The UsersController login() method performed a pre-authentication database query that selected only User.password, User.totp, and User.hotp_counter, omitting User.disabled. The TOTP verification branch then attempted to read the disabled flag from the result set; when the column was absent, PHP returned an undefined-array-key warning and the boolean check evaluated as null (falsy), bypassing the disabled-user guard. A subsequent identify() call re-validates the user state and correctly rejects disabled accounts, limiting practical impact to information disclosure and log noise.
Affected products
- MISP Project MISP
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fix commit 3df982a adds User.disabled to the pre-auth SELECT clause