MISP EUVD-2026-90550

Exploitation requires ALL of the following to align: (1) the target MISP user has TOTP-based two-factor authentication enabled (the flaw only matters when this hardening feature is active); (2) the attacker is positioned to observe or intercept the live TOTP code during a genuine login - e.g., network-level interception/MITM, shoulder-surfing, or a compromised client endpoint - and in practice must also obtain the first-factor credentials to complete the login; and (3) the replay occurs within the single TOTP validity period (typically ~30 seconds). These interception and tight-timing requirements are the key limiters: the flaw is not remotely exploitable against an arbitrary user without an interception vantage point, so despite PR:N it is not a drive-by unauthenticated attack. Affected in all versions before v2.5.48; fixed by recording consumed TOTP steps in Redis.

This is a CWE-294 capture-replay weakness in MISP's TOTP second-factor verification: the login flow did not mark a TOTP time-step as consumed, so a captured code stayed valid for its full ~30s window and could be replayed to log in a second session. The vendor CVSS 4.0 score of 9.3 (Critical) is driven by AV:N/AC:L/AT:N/PR:N/UI:N and VC:H/VI:H, but that rating materially overstates real-world risk because it ignores the explicit preconditions in the description: the attacker must already be positioned to intercept a valid code (network MITM, shoulder-surfing, or a compromised client) AND act within the short validity window. Those are genuine attack requirements, so AT:N (and AC:L) are optimistic - an interception-plus-timing precondition is better modeled as AC:H/AT:P, which is why my independent 3.1 score lands near 8.0 rather than 9.3. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the supplied data, so this is not evidence of active or automatable exploitation; it is a defense-in-depth weakening of 2FA that requires an attacker who can already observe traffic/credentials. Net: a legitimate issue worth patching (a vendor fix exists), but a conditional, position-dependent flaw rather than a wormable mass-exploitation priority despite the Critical headline number.

An attacker who can observe a target user's MISP login - e.g., via a man-in-the-middle position on the network, shoulder-surfing, or malware on the user's client - captures the 6-digit TOTP code as it is submitted. Within the same ~30-second validity window the attacker replays that code (alongside the user's first-factor credentials) to the MISP login endpoint and authenticates a second, parallel session as the victim, gaining access to the threat-intelligence data and any administrative functions that account holds. No public exploit code is identified at time of analysis.