CVE-2026-107276Medium· 6.3▾ SunlitMISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cau…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.
Preconditions:
The target MISP instance has email OTP login enabled.
The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).
The attacker can issue two HTTP POST requests in close temporal proximity.
Impact:
The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.
This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.
Affected versions: <2.5.48
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103651High· 7.6MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a …
CVE-2020-8890Medium· 5.9An issue was discovered in MISP before 2.4.121
CVE-2026-112192Medium· 5.3MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
CVE-2026-112188High· 7.1MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
CVE-2026-112184Medium· 4.8MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
CVE-2026-112183Medium· 4.8MISP CSS Injection via Remote Tag Colour in Event Preview