EUVD-2026-38228
GHSA-ch28-mjgc-m4wr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable login flow but session fixation needs a same-site cookie-priming foothold plus victim interaction (AC:H, UI:R); no auth needed to initiate the attack itself, leading to full account takeover (C:H/I:H, A:N).
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
3DescriptionCVE.org
The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol.
The application used the PHP session identifier (session_id()) as the OAuth state parameter. Because session identifiers are long-lived authentication credentials, exposing them in OAuth redirect URLs could leak valid session tokens through browser history, HTTP Referer headers, reverse proxies, access logs, or third-party infrastructure involved in the authentication flow. If obtained by an attacker, the leaked session identifier could potentially be used for session hijacking.
Additionally, the implementation did not regenerate the session identifier after successful authentication, leaving authenticated sessions susceptible to session fixation attacks where an attacker forces a victim to use a known session identifier before login and later reuses that identifier after authentication.
The OAuth state value was also not implemented as a dedicated, single-use nonce. This weakened CSRF protections and increased the risk of replay attacks against the OAuth callback process.
The authentication flow further failed to enforce HTTPS for the configured OAuth redirect URI. If a non-HTTPS redirect URI was used, OAuth authorization codes and access tokens could traverse the network in plaintext, exposing sensitive credentials to network attackers.
Finally, OAuth error responses containing attacker-controlled GET parameters were logged verbatim. An attacker could inject control characters or crafted log content, leading to log forging, log injection, or corruption of audit records.
The fix introduces:
* A dedicated cryptographically random OAuth state value.
* Single-use state validation and invalidation.
* Constant-time state comparison using hash_equals().
* Session identifier rotation after successful authentication.
* Enforcement of HTTPS-only redirect URIs.
* Sanitized and length-limited logging of OAuth error parameters.
AAD Authentication Plugin (OAuth 2.0 / Azure Active Directory integration)
Articles & Coverage 1
AnalysisAI
Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijacking, session fixation, CSRF/replay against the OAuth callback, plaintext credential exposure over non-HTTPS redirect URIs, and log injection. The plugin reused the PHP session_id() as the OAuth state parameter, never rotated the session ID after login, did not enforce HTTPS on the redirect URI, and logged attacker-controlled GET parameters verbatim. No public exploit identified at time of analysis, but an upstream fix is available in MISP commit 146bc40.
Technical ContextAI
The vulnerable component is the AadAuth CakePHP plugin shipped with MISP (cpe:2.3:a:misp:misp), which implements OAuth 2.0 / OpenID Connect against Azure AD. Root cause is CWE-384 (Session Fixation), compounded by misuse of the OAuth state parameter as a security primitive: PHP session IDs are long-lived bearer credentials, and embedding them in redirect URLs causes them to be persisted in browser history, sent in HTTP Referer headers, and recorded by proxies, CDNs, and access logs in the redirect chain to and from login.microsoftonline.com. The implementation also performed non-constant-time state comparison via strcmp, never invalidated state values after use (no nonce semantics), skipped session_regenerate_id() after login (per a code comment, this had previously broken the AAD flow because the state check itself relied on the session ID), and trusted the operator-configured redirect_uri scheme.
RemediationAI
Upstream fix available (commit 146bc40ad6e10a44f01e8ed62d5f7bc9c06cc4fa on github.com/MISP/MISP); released patched version not independently confirmed from the input data - upgrade to a MISP release that includes this commit, or cherry-pick it onto your current branch. As compensating controls until you can deploy the patch: (1) ensure the configured AAD redirect_uri uses https:// (the patch now refuses to proceed without it, but pre-patch you must enforce this yourself) to prevent authorization codes and access tokens crossing the network in plaintext; (2) avoid using ad_tenant=common with check_ad_groups=false, since per the updated README this configuration lets any Microsoft account sharing an email with a MISP user log in as that user; (3) restrict who can read MISP and reverse-proxy access logs and rotate any session IDs that may have been written to them; (4) consider temporarily disabling the AadAuth plugin and falling back to local or another SSO backend if patching is delayed. Trade-off: enforcing HTTPS will break setups that terminate TLS at a proxy and configure redirect_uri as http://; reconfigure the proxy to preserve the https scheme via X-Forwarded-Proto / the public URL.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-384 – Session Fixation
View allShare
External POC / Exploit Code
Leaving vuln.today