A missing rate‑limiting check in MISP’s email‑based one‑time password verification flow let an attacker submit unlimited OTP guesses while the current code remained valid. Because the OTP is associated with the user instead of a single session, multiple concurrent sessions could try many guesses against the same token, making it far easier to brute‑force and bypass the second authentication factor. The consequence is that anyone who has obtained initial credentials could gain unfettered access to the victim’s account.

The vulnerability affects the MISP platform from the MISP core project. Specific product names include the common MISP Community Edition, but no particular version ranges were supplied.

With a CVSS score of 8.6 the issue is classified as high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely remote after a user has already authenticated normally; the attacker then repeatedly submits OTP values until the sequentially valid token is exhausted. The lack of a limit makes the exploitation straightforward for anyone with initial credentials, increasing the risk of unauthorized access and potential data exposure.