Description
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup.

The initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag).

Impact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy.

Affected version: <2.5.48
Published: 2026-10-07
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Two-factor authentication bypass
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in MISP’s two‑factor authentication enforcement logic. On instances configured with Security.otp_required, the check that redirects unauthenticated users to the TOTP setup page is only applied to standard browser requests. Non‑browser request shapes—including AJAX/XHR calls, REST API requests, .json URLs, and automation actions—do not trigger the redirect, so the guard is bypassed. An authenticated user who has not enrolled in TOTP can thus issue any non‑browser request and retain full access, nullifying the intended two‑factor protection. This is a standard authentication bypass flaw (CWE‑287) combined with missing required authentication (CWE‑306).

Affected Systems

Affected systems are installations of the MISP platform, version 2.5.47 and earlier, which had the otp_required flag enabled. The fix was implemented in commits 8deb0619e and 6b527ba6e and is included from MISP 2.5.48 onward.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact, though the EPSS score is unavailable and the vulnerability is not listed in KEV. An attacker needs to be authenticated and authorized to make non‑browser requests, which is a realistic scenario for internal users or compromised scripts. Effective exploitation can occur without special privileges beyond those normally granted to legitimate API or automation users. Upgrading to the fixed release mitigates the flaw instantly.

Generated by OpenCVE AI on October 7, 2026 at 14:53 UTC.

Remediation

Vendor Solution

The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow.

OpenCVE Recommended Actions

  • Upgrade the MISP installation to version 2.5.48 or later so that all non-browser requests are guarded against TOTP bypass
  • Verify that the Security.otp_required configuration remains enabled for your instances
  • Audit all user accounts to confirm that each authenticated user has enrolled in TOTP and enroll any that are missing
  • Monitor application logs for non-browser requests originating from accounts that have not completed TOTP enrollment and investigate any suspicious activity

Generated by OpenCVE AI on October 7, 2026 at 14:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup. The initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag). Impact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy. Affected version: <2.5.48
Title MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
First Time appeared Misp
Misp misp
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp
Misp misp
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-10-07T14:40:54.178Z

Reserved: 2026-10-07T12:49:37.658Z

Link: CVE-2026-107180

cve-icon Vulnrichment

Updated: 2026-10-07T14:40:49.008Z

cve-icon NVD

Status : Deferred

Published: 2026-10-07T13:17:22.003

Modified: 2026-10-07T15:17:19.630

Link: CVE-2026-107180

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T15:00:07Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function