MISP CVE-2026-103651

Requires three concrete, stacked prerequisites explicitly stated in the advisory: (1) the target user has HOTP (paper-token) second-factor authentication enabled in MISP - TOTP-only or no-2FA users are unaffected; (2) the attacker already holds a valid session in which the password step is completed and only the OTP step is pending, implying prior compromise of the user's password; and (3) the attacker has at least one valid HOTP token value (e.g., a copy of the paper token list). The limiting factors are substantial: authentication (PR:L) via a known password is required, HOTP paper tokens must be the configured second factor, and the attacker needs access to a token value - making this an insider/post-password-compromise scenario rather than an anonymous remote exploit. Fixed in MISP 2.5.48.

Vendor CVSS 4.0 scores this 7.6 (High) with AV:N/AC:H/PR:L/UI:N and VC:H/VI:H, which is consistent with the described impact: a second-factor bypass yielding full account takeover (confidentiality and integrity high, no availability impact). The real-world risk is moderated significantly by the attack prerequisites baked into the vector - PR:L and AC:H are both well-justified because the attacker must already hold a valid authenticated session with the password step completed AND possess at least one valid HOTP paper-token value, then exploit stale session-cached counter state. This is not a remote, unauthenticated, point-and-click flaw. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The CWE-362 (race condition) classification is somewhat loose - the root cause per the description and patch is a logic/replay flaw (verifying against a session-cached counter instead of the authoritative DB counter), though the vendor fix does add a Redis lock to serialize consumption, giving the race framing some basis. Net: a legitimate, patch-worthy 2FA-integrity defect, but a targeted/insider-flavored issue rather than a mass-exploitation priority, given the stacked preconditions (valid session + possession of a paper token).

An attacker who has already obtained a user's password (completing the login's first step and holding a pending-OTP session) and who has observed or captured at least one HOTP paper-token value replays a previously-used token. Because MISP verifies the submitted token against the counter cached in the session rather than the incremented authoritative value in the database, the burned token still validates, bypassing the second factor and granting account access while corrupting the HOTP counter. No public exploit code is identified at time of analysis.