MISP’s email‑based one‑time password flow contains a race condition where the OTP is read, validated, and deleted in separate operations. When two HTTP POST requests with the same valid OTP are sent concurrently, both can read the same OTP before the first request deletes it, allowing the same code to create two separate authenticated sessions. This violates the core promise of once‑use and can lead to unauthorized access if the OTP is intercepted or shared.

The flaw affects all MISP installations that have email OTP login enabled and are running versions earlier than 2.5.48. The vulnerability is present regardless of the deployment size or hosting environment, as it relies solely on the application logic and shared data store accessed by concurrent requests.

With a CVSS score of 6.3 the vulnerability is classified as moderate severity. No EPSS score is available and it is not listed in the CISA KEV catalog, suggesting a lower observable exploitation frequency so far. However, the attack requires the attacker to possess a valid, unexpired OTP—obtained through interception or social engineering—and the ability to submit two near‑simultaneous login requests. If successful, the attacker obtains a second session without needing to crack credentials, representing a significant security risk.