Is CVE-2026-95754 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95754 being exploited in the wild.

How severe is CVE-2026-95754?

Informational severity, published 22 September 2026.

Is there a fix for CVE-2026-95754?

A patch was published on 2026-09-22: Fix commit 3df982a adds User.disabled to the pre-auth SELECT clause Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95754 attacked?

It is attacked over the network.

Am I affected by CVE-2026-95754?

Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95754: MISP UsersController auth bypass via missing disabled-user check in TOTP branch

CVE-2026-95754 · Severity: info · Published 2026-09-22

MISP, a threat intelligence platform, had a flaw in its two-factor authentication (TOTP) login flow where disabled user accounts were not properly rejected. Instead of being denied access immediately, a disabled user enrolled in TOTP would be asked to enter their second factor, disclosing that the account exists. While subsequent checks still prevented actual account access, this creates a minor information leak and generates spurious warnings in application logs.

Technologies: MISP Project MISP. Vendors: MISP Project.

Quick answers

Is CVE-2026-95754 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95754 being exploited in the wild.
How severe is CVE-2026-95754?: Informational severity, published 22 September 2026.
Which products and versions are affected?: MISP Project MISP.
Is there a fix for CVE-2026-95754?: A patch was published on 2026-09-22: Fix commit 3df982a adds User.disabled to the pre-auth SELECT clause Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95754 attacked?: It is attacked over the network.
Am I affected by CVE-2026-95754?: Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The UsersController login() method performed a pre-authentication database query that selected only User.password, User.totp, and User.hotp_counter, omitting User.disabled. The TOTP verification branch then attempted to read the disabled flag from the result set; when the column was absent, PHP returned an undefined-array-key warning and the boolean check evaluated as null (falsy), bypassing the disabled-user guard. A subsequent identify() call re-validates the user state and correctly rejects disabled accounts, limiting practical impact to information disclosure and log noise.

Affected products

MISP Project MISP

Timeline

2026-09-22: disclosed
2026-09-22: patched: Fix commit 3df982a adds User.disabled to the pre-auth SELECT clause

References

https://github.com/MISP/MISP/commit/3df982ab1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.