Which versions of MISP are affected by CVE-2026-10611?

MISP threat intelligence platform deployments with both LDAP authentication and one-time password enforcement enabled are vulnerable to a second-factor authentication bypass, allowing attackers with…

How to fix or mitigate CVE-2026-10611?

Within 24 hours: Identify all MISP instances where LdapAuth.mixedAuth=true and Security.require_otp=true are both enabled; immediately disable one of these settings (recommend disabling LdapAuth.mixedAuth if operationally feasible, or temporarily disabling OTP requirement). Within 7 days: Audit authentication logs for any indicators of unauthorized access; implement network-layer access restrictions to MISP using IP whitelisting; enable comprehensive authentication logging. Within 30 days: Monitor MISP project advisories for patch release; evaluate and test patch in non-production environment; plan production deployment with change control.

MISP CVE-2026-10611

Q: What is the CVSS score of CVE-2026-10611?

CVE-2026-10611 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33917 HIGH

Improper Authentication (CWE-287)

2026-06-02 5a6e4751-2f3f-4070-9419-94fb35b644e8

GHSA-679g-pp8v-jvg4

Authentication Bypass Misp

8.2

CVSS 4.0 · Vendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Severity by source

Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8) · only source for this CVE.

CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 14:34 vuln.today

Analysis Generated

Jun 02, 2026 - 14:34 vuln.today

DescriptionCVE.org

An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established during the application beforeFilter phase before the normal login flow enforces the OTP challenge.

As a result, an attacker with valid primary authentication credentials could bypass the required OTP step by authenticating through the plugin-backed login flow and then directly accessing another application URL instead of completing the OTP verification page. This allows access to the application as the affected user without providing a valid TOTP, HOTP, or email OTP code.

The issue affects configurations where plugin-based authentication is enabled and OTP is expected to be mandatory. The fix ensures that OTP requirements are checked immediately after plugin authentication and before the user session is established, redirecting users to the appropriate OTP challenge when required.

AnalysisAI

OTP authentication bypass in MISP affects deployments where LdapAuth.mixedAuth=true is combined with Security.require_otp=true, allowing attackers with valid LDAP (or other plugin) credentials to skip the mandatory second factor. Because the plugin-driven login establishes the session during the AppController beforeFilter phase, an attacker can authenticate, ignore the /users/otp challenge page, and browse directly to any authorized application URL as the victim. No public exploit identified at time of analysis, though the upstream commit clearly documents the bypass technique.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a PHP/CakePHP threat-intelligence platform that supports pluggable authentication backends such as LDAP alongside its native form login. When mixed authentication is enabled, plugin-authenticated users are processed inside AppController::_loadAuthenticationPlugins() during CakePHP's beforeFilter hook, which fires before UsersController::login() can apply the OTP gate. The root cause is CWE-287 (Improper Authentication): a missing second-factor check at the boundary between plugin authentication and session establishment, so the TOTP/HOTP/email-OTP requirement enforced for native logins was not consistently applied to LDAP-authenticated sessions.

RemediationAI

Upstream fix available (commit 39b3cb15aac4318afdd2ab63b96c2eac12b271fe); a released patched version is not independently confirmed in the supplied data, so administrators should track the next MISP release that includes this commit or cherry-pick it from https://github.com/MISP/MISP/commit/39b3cb15aac4318afdd2ab63b96c2eac12b271fe into their deployment. As an interim compensating control, set LdapAuth.mixedAuth=false to force LDAP users through the normal login flow that already enforces OTP - this prevents the bypass but removes the convenience of mixed authentication and may break header/SSO-style integrations. Alternatively, disable OTP plugin-based logins by removing Security.require_otp until the patch is applied if mixedAuth cannot be turned off, accepting that LDAP credentials alone will then gate access; both workarounds reduce assurance, so patching is strongly preferred.