The OIDC authentication plugin for MISP automatically linked an OIDC identity to a local user account when the local account had no stored sub value and the email claim matched. On IdP configurations that do not enforce legitimate ownership of the email address, an attacker who can acquire a valid OIDC token can simply assert the victim’s email and be authenticated as that user. The effect is a full account takeover, granting the attacker read, write, and administrative capabilities on the MISP instance belonging to the victim. The weakness corresponds to CWE-287, Authentication Failure.

The vulnerability applies to the MISP project, specifically to any release that includes the OIDC authentication plugin without additional safeguards for email verification or sub claim checks. No specific version range is listed, so any version employing this plugin can be affected if configured with an insecure IdP.

The CVSS score of 6 indicates moderate severity. The EPSS score is unavailable, so the likelihood of exploitation in the wild cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The attack can be executed only if the attacker has a valid OIDC token for an IdP that does not prove email ownership, making the exploitation context dependent on IdP configuration and token issuance.