MISP CVE-2026-10861

The victim must click a specifically crafted MISP URL that encodes an external redirect target, and must successfully complete authentication to the MISP instance - the redirect only fires post-login via the _postlogin() code path. The CVSS vector confirms PR:N (no attacker authentication required) and UI:A (victim interaction is mandatory). Exploitation is limited to scenarios where the attacker can deliver a convincing link to a MISP user with valid credentials; unauthenticated users who fail login or users who navigate to MISP directly rather than via the crafted link are not affected. No special server-side configuration is required - the vulnerability exists in default MISP deployments on all versions through 2.5.38. Exploitation is constrained to social engineering impact (phishing redirection) and cannot achieve code execution, data exfiltration from MISP itself, or privilege escalation on the host.

CVSS 4.0 rates this 5.1 (Medium). The vector AV:N/AC:L/AT:N/PR:N/UI:A reflects that no privileges are required from the attacker, complexity is low, but victim interaction is mandatory - the attack cannot succeed without the user clicking the crafted link and completing authentication. Confidentiality and integrity impact is limited to the subsequent system scope (SC:L), with no direct impact on the MISP host itself (VC:N/VI:N/VA:N). SSVC corroborates this: exploitation is currently 'none', technical impact is only 'partial', though the 'automatable: yes' flag indicates mass-delivery phishing campaigns are feasible at scale. No EPSS score was provided. There is no CISA KEV listing and no public proof-of-concept code has been identified at time of analysis. The primary real-world risk is not system compromise but trust exploitation: MISP is used extensively by national CERTs, ISACs, and enterprise threat intelligence teams - a redirect from a known-trusted MISP instance carries unusually high credibility for credential-harvesting campaigns targeting those communities. CVSS alone would rank this as low priority; the operational context of the affected platform elevates realistic risk for targeted phishing scenarios.

An attacker targeting a security operations team crafts a URL to a victim organization's MISP instance where the pre_login_requested_url session parameter is set to an external phishing domain, such as a convincing clone of the organization's identity provider login page. The attacker delivers this link via a spear-phishing email referencing a specific threat report, inducing the analyst to click and authenticate. Upon successful login, MISP immediately redirects the analyst to the attacker's external site - which may re-request credentials under the guise of a session timeout - with the legitimacy of the redirect reinforced by the trusted MISP origin. No public proof-of-concept code has been identified at time of analysis, but the attack requires no technical sophistication beyond URL construction.