MISP CVE-2026-94379

Apply the vendor fix by upgrading MISP to 2.5.47 or later, or by applying upstream commit ef4dc19c6 (https://github.com/MISP/MISP/commit/ef4dc19c6), which rewrites the method checks in login() and updateLoginTime() so that all non-GET requests pass through the bruteforce blocklist, attempt counter, email OTP verification, and login-failure logging; no released patched build was independently confirmed beyond the vendor's stated "<2.5.47" affected range, so verify the deployed version after upgrading. If upgrading cannot be done immediately, restrict the login endpoint at the perimeter: configure the reverse proxy or WAF in front of MISP to accept only POST to the login route and reject other methods with 405, which is a targeted change but can break clients, scripts, or integrations that legitimately use alternate verbs and must be regression-tested. Because the flaw also disables the attempt counter and failure logging, add external compensating controls during the exposure window - rate-limit and temporarily block source IPs with repeated login failures at the proxy or firewall, and monitor web server access logs for abnormal volumes of requests to the login endpoint from a single source, since MISP's own audit trail cannot be relied upon for this attack class. Note that enabling additional application-side MFA or lockout settings does not help, because those code paths are exactly what the bypass skips; only perimeter enforcement or the code fix restores protection.