Description
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.


As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim's authenticated MISP session, potentially gaining the privileges associated with the victim's account.


The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session->renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.
Published: 2026-09-03
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Session Hijacking
Action: Patch
AI Analysis

Impact

A session fixation flaw exists in the CustomAuth authentication path of MISP. When a user authenticates, the system writes the authenticated identity to the current session without rotating the session identifier. The vulnerability is classified as CWE‑384, meaning an attacker can reuse an existing session ID to impersonate another user after they authenticate. This could grant the attacker the victim’s privileges within MISP.

Affected Systems

The flaw affects the MISP platform, specifically the CustomAuth authentication configuration. No specific version range is listed, so any deployment using CustomAuth is potentially impacted until a patch is applied.

Risk and Exploitability

The CVSS score is 7.6, indicating a high risk to confidentiality, integrity, and availability. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. An attacker must cause a victim to use a known session ID prior to authentication – an action that is plausible via web session cookie manipulation or social engineering. Once authenticated, the attacker can reuse the fixed session ID to hijack the victim’s session and access data or perform actions with the victim’s permissions.

Generated by OpenCVE AI on September 3, 2026 at 16:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest MISP release or community patch that restores session identifier rotation upon authentication.
  • Verify that the configuration sets Session->renew() to true for CustomAuth to enforce session ID regeneration.
  • If upgrading is not immediately possible, disable the CustomAuth authentication flow or restrict its use until the patch is deployed.

Generated by OpenCVE AI on September 3, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Misp-project
Misp-project misp
CPEs cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp-project
Misp-project misp
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Fri, 04 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Thu, 03 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Description MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim's authenticated MISP session, potentially gaining the privileges associated with the victim's account. The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session->renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.
Title Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
Weaknesses CWE-384
References
Metrics cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
Misp-project Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-03T15:43:12.832Z

Reserved: 2026-09-03T15:29:58.290Z

Link: CVE-2026-85238

cve-icon Vulnrichment

Updated: 2026-09-03T15:43:10.304Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-03T16:18:27.313

Modified: 2026-09-11T14:17:04.047

Link: CVE-2026-85238

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T17:00:06Z

Weaknesses