CVE-2026-90961
CriticalCVSS 9.3Summary
The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.
Risk Assessment
An attacker who knows a valid email address can gain full privileges of that user, including administrative access to threat intelligence data. No prior authentication is required, posing a critical risk to data confidentiality and integrity.
Recommendation
Upgrade MISP to a version newer than 2.5.45 immediately. If not possible, temporarily disable the LdapAuth and LinOTPAuth plugins or apply WAF rules to reject requests with empty or non-string email/password fields.
Other vulnerabilities in MISP
See all- CVE-2026-90957Medium
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. Malicious scripts inside SVG can execute when the SVG is navigated to directly or embedded as a document, running on the MISP origin with the viewer's session. This affects organisation SVG logos and event-report SVG pictures. The vulnerable behavior is on the serve path, not merely the upload path. Version affected: ≤2.5.45.
- CVE-2026-90955Medium
Affected versions of MISP's interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45.
- CVE-2026-90895High
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users; - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view(); - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked; - server synchronization authkey values were not explicitly hidden from CLI detail output; - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised(); - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45
- CVE-2026-90893Medium
MISP version <= 2.5.45 contains a CSRF vulnerability in UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were added to the unlockedActions list, disabling all CSRF validation (both token and field-hash checks) for those endpoints, allowing an attacker to forge requests that change a logged-in user's settings.
- CVE-2026-88921Medium
MISP version ≤2.5.45 contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which renders MISP element references (attributes, objects, and tags) into inline HTML during PDF report export. User-controlled fields (attribute type and value, object name and relation, tag name and colours) are interpolated into HTML templates without HTML entity encoding. Additionally, the attribute() method contains hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, causing every plain attribute reference in a PDF to display the sample text rather than the actual indicator value.
- CVE-2026-61474Medium
An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.
- CVE-2017-14337High
In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.
- CVE-2026-86419Critical
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination, and original request headers were reused, potentially forwarding authentication headers or API credentials to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results. The TAXII discovery endpoint had a related incomplete SSRF defense using gethostbyname() and comparing against only a few literal addresses, missing cases like IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.
- CVE-2026-85221Critical
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null, which when passed to cURL effectively disabled TLS peer verification unless the calling code explicitly enabled it. As a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority.
- CVE-2026-85216Critical
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.
Original NVD description (English source)
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings. In the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes. In the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string. A secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access. The vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data. Version affected: ≤2.5.45