CVE-2026-90961

CriticalCVSS 9.3

Published: 14/09/2026(UTC)Updated: 16/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

39th percentile - higher than 39% of all known CVEs

Summary

The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.

Risk Assessment

An attacker who knows a valid email address can gain full privileges of that user, including administrative access to threat intelligence data. No prior authentication is required, posing a critical risk to data confidentiality and integrity.

Recommendation

Upgrade MISP to a version newer than 2.5.45 immediately. If not possible, temporarily disable the LdapAuth and LinOTPAuth plugins or apply WAF rules to reject requests with empty or non-string email/password fields.

Other vulnerabilities in MISP

See all

Original NVD description (English source)

The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings. In the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes. In the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string. A secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access. The vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data. Version affected: ≤2.5.45

Vulnerability data from NVD (NIST) · CISA KEV · EPSS