SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2026-85216

CriticalCVSS 9.8
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.50%

41th percentile - higher than 41% of all known CVEs

Summary

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.

Risk Assessment

A remote unauthenticated attacker can impersonate an existing MISP user, including administrators, gaining access to sensitive threat-intelligence data, the ability to modify or delete information, alter configuration, or perform other privileged operations.

Recommendation

Apply the vendor-provided patch immediately, which enforces that authentication identifiers and passwords are valid strings, rejects empty passwords where not explicitly permitted, and assigns a randomly generated local password to LDAP-provisioned accounts. After updating, audit existing accounts for empty passwords.

Other vulnerabilities in MISP

See all
Original NVD description (English source)

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate its credential validation checks. As a result, empty or non-string values could reach the underlying authentication mechanisms. In the LDAP authentication path, an attacker able to identify a valid directory user's email address could submit an empty password. The empty credential could be passed to ldap_bind(), where an LDAP server accepting unauthenticated binds may return a successful result for a valid distinguished name combined with an empty password. MISP could consequently treat the attacker as the corresponding authenticated directory user without verification of the user's password. The issue also affected the LinOTP authentication component. Invalid credential types were not rejected before being processed, and when mixed authentication was enabled, an empty password could be checked against a locally stored MISP password hash. LDAP-provisioned MISP accounts could additionally be created with an empty local password because account creation skipped normal validation, resulting in a hash corresponding to an empty password. This could permit authentication through the local fallback mechanism when such an account was no longer resolved through LDAP. Successful exploitation could allow a remote unauthenticated attacker to impersonate an existing MISP user. If the targeted account has administrative or other privileged permissions, the attacker could gain corresponding access to sensitive threat-intelligence data, modify or delete information, alter configuration, or perform other privileged operations. The patch resolves the vulnerability by requiring authentication identifiers and passwords to be valid strings, rejecting empty passwords where they are not explicitly permitted, and assigning a randomly generated local password to LDAP-provisioned accounts instead of storing a hash derived from an empty password.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS