The vulnerability arises because custom LDAP and LinOTP authentication components in MISP fail to validate the format and presence of credentials, allowing empty or non-string values to be accepted by the underlying authentication mechanisms. This coding oversight permits a remote user to submit an empty or invalid password for a known directory account, and in the case of LDAP servers that allow unauthenticated binds, the bind succeeds for the target distinguished name. Similar logic applies to LinOTP authentication where empty passwords are accepted and may match a locally stored hash, culminating in implicit authentication. Consequently, an attacker can impersonate any valid MISP user, even those with administrative privileges, and gain full read‑write access to threat‑intelligence data, configurations, or other sensitive operations. The weakness is a classic example of improper authentication, classified as CWE‑521.

All installations of the MISP platform that utilize the LDAP or LinOTP authentication modules are potentially affected. Detailed version information is not provided; the flaw exists in any configuration where these components are active. Administrators should review whether their deployments rely on these authentication paths and note that any user with known email or directory credentials is susceptible.

The CVSS score of 9.5 marks this as a critical vulnerability, and the absence of a published EPSS score suggests current exploitation uncertainty; however, the risk remains high because the attack can be conducted remotely without prior authentication and the impact includes data theft, modification, or destruction. The vulnerability is not yet listed in the CISA KEV catalog, implying no publicly confirmed exploits, but the flaw is straightforward to exploit if an LDAP server supports anonymous binds or if invalid credential handling is not corrected. Attackers therefore can feasibly bypass authentication and obtain arbitrary privileged access in vulnerable MISP instances.