Is there a patch available for CVE-2026-9084?

Yes, a patch is available for CVE-2026-9084. Update the affected software to the latest version immediately.

MISP CVE-2026-9084

Q: What is the CVSS score of CVE-2026-9084?

CVE-2026-9084 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31123 MEDIUM

Improper Authentication (CWE-287)

2026-05-20 CIRCL

GHSA-5895-8h7c-2833

Authentication Bypass Misp

6.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 16:03 vuln.today

Analysis Generated

May 20, 2026 - 16:03 vuln.today

DescriptionCVE.org

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

AnalysisAI

Account takeover in MISP's OidcAuth plugin (versions 2.5.0 through 2.5.37) enables an unauthenticated attacker holding a valid OIDC token from an insecure or untrusted IdP to authenticate as any local MISP user whose account has a NULL stored sub value. The vulnerability arises because the plugin unconditionally trusted the OIDC email claim to link identities to existing local accounts without verifying email ownership, bypassing authentication controls entirely (CWE-287). No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.0 reflects adjacent network vector and high complexity conditions that constrain realistic exposure.

Technical ContextAI

MISP's OidcAuth plugin is a CakePHP-based authentication component located at app/Plugin/OidcAuth/Lib/Oidc.php. During OIDC login, the plugin correlates the incoming token's sub claim to a local MISP user record. For accounts created locally (i.e., never previously authenticated via OIDC), the sub field is NULL. The vulnerable code branch checked for a sub mismatch - correctly rejecting tokens where the stored sub differed - but contained no guard against the NULL sub case, causing it to silently accept any token whose email claim matched an existing local account. This maps directly to CWE-287 (Improper Authentication): ownership of the asserted email identity was never validated. The fix, committed to the MISP repository at 71f5662c1b5886613d2cd5c72fd93bb4ca6fa172, introduces two new opt-in configuration flags - OidcAuth.allow_email_linking (default: false) and OidcAuth.require_email_verified (default: true) - disabling the email-linking behavior by default and requiring email_verified=true when it is re-enabled. Affected CPE is cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream fix from the MISP GitHub repository at https://github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172, which changes the default behavior of the OidcAuth plugin to deny email-based identity linking. As an immediate compensating control prior to patching, explicitly set OidcAuth.allow_email_linking = false in MISP's configuration - this mirrors the patched default and blocks automatic linking of OIDC identities to accounts with a NULL sub. If email-based linking must remain enabled for account migration purposes, additionally set OidcAuth.require_email_verified = true (also the patched default) and verify that the configured IdP enforces email ownership and issues the email_verified=true claim reliably; enabling linking against an IdP that does not provide this guarantee reintroduces the vulnerability. Disabling the OidcAuth plugin entirely for deployments that do not require OIDC is a zero-risk mitigation with no functional impact on local-auth users. Monitor the official MISP releases at https://github.com/MISP/MISP/releases for a tagged version incorporating this fix.