The Azure Active Directory authentication plugin in MISP misuses the PHP session identifier as the OAuth state parameter, exposing long‑lived session credentials in redirect URLs. This leakage occurs through browser history, HTTP Referer headers, reverse proxies, and application logs, allowing attackers to hijack sessions. In addition, the plugin does not rotate the session identifier after successful login, leaving authenticated sessions vulnerable to session fixation. The state value is also not treated as a dedicated single‑use nonce, weakening CSRF protections and creating a replay attack vector. The implementation permits non‑HTTPS redirect URIs, so authorization codes and access tokens can be transmitted over the network in cleartext, exposing credentials to network attackers. Finally, attacker‑controlled error parameters are logged verbatim, enabling log injection and corruption of application logs. Collectively, these weaknesses let an attacker fully compromise a victim’s authenticated session and tamper with application logs.

The vulnerability affects the MISP platform’s Azure Active Directory authentication plugin. No specific version information is provided in the advisory.

The CVSS base score of 9.3 indicates critical severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. The likely attack vector is external remote exploitation via the OAuth redirect flow: an attacker can craft or intercept a malicious redirect URI to obtain a session identifier or authorization code, bypass CSRF defenses by reusing the state value, or capture credentials if the redirect URI is not HTTPS. Network attackers could also sniff plaintext tokens if HTTPS enforcement is missing, and log injection is possible through crafted error parameters.