MISP CVE-2026-107276

Three concrete conditions must all hold: (1) the MISP instance has email-based OTP login enabled (not the default for every deployment); (2) the attacker already possesses a valid, unexpired OTP for the target user, obtained via email interception or social engineering - the flaw cannot be triggered without this code; and (3) the attacker can issue two login POST requests within the narrow window between the OTP read/validate and its deletion. Limiting factors: AC:H reflects that the race window is small and timing-dependent, success only duplicates a session the OTP would already have granted, and impact is confined to low integrity (no confidentiality or availability loss).

This is a genuine but low-urgency issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N, score 6.3 Medium) is internally consistent with the description: AC:H correctly reflects that the attacker must win a narrow non-atomic read/validate/delete race in Redis, and the impact is limited to low integrity (VI:L/SI:L) with no confidentiality or availability effect. The most important mitigating signal is a precondition the raw vector understates - PR:N is technically accurate (the attacker holds no MISP account privileges) but exploitation requires already possessing a valid, unexpired OTP obtained out-of-band (email interception or social engineering), so this is not a standalone remote-unauthenticated compromise. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified; the only code artifact is the vendor's fix commit, not a weaponized POC. Net effect of a successful race is marginal - a single OTP yields two sessions rather than one - which does not meaningfully expand access an OTP holder would not otherwise obtain. Treat as a defense-in-depth hardening fix (patch in normal cycle), not an emergency.

An attacker who has intercepted or socially engineered a victim's valid email OTP submits two MISP login POST requests simultaneously, racing the check-then-delete window so both reads see the still-present OTP before either deletion commits, yielding two authenticated sessions from one code. No public exploit code was identified at time of analysis; the only available artifact is the vendor patch commit, and the high attack complexity (AC:H) makes reliable race-winning non-trivial.