MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.
Preconditions:
- The target MISP instance has email OTP login enabled.
- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).
- The attacker can issue two HTTP POST requests in close temporal proximity.
Impact:
- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.
- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.
Affected versions: <2.5.48
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/MISP/MISP/commit/ba95e67d5 |
Configurations
No configuration.
History
07 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-07 16:17
Updated : 2026-10-07 21:17
NVD link : CVE-2026-107276
Mitre link : CVE-2026-107276
CVE.ORG link : CVE-2026-107276
JSON object : View
Products Affected
No product.