Description
The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: 

 - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked
 -  the email OTP two-factor authentication step was skipped, defeating the second factor of authentication
 - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.




The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.





Version affected: <2.5.47
Published: 2026-09-21
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Bypass of login security controls enabling credential compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in MISP’s login endpoint, where the code only enforced security checks for POST and PUT HTTP methods. An attacker can send requests using any other method, such as PATCH, DELETE, or OPTIONS, thereby bypassing brute‑force protection, the email OTP two‑factor authentication, and the login‑failure logging. The result is that credential‑guessing is unrate‑limited, the second authentication factor is defeated, and audit trails are not generated, allowing potential unauthorized access to the instance.

Affected Systems

MISP (version 2.5.x before 2.5.47) is affected. Any deployment running PHP code that exposes the login page without the patch will be vulnerable.

Risk and Exploitability

The flaw is assessed with a CVSS score of 6.9, indicating a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is an unauthenticated user crafting a non‑POST/PUT HTTP request to the login endpoint, which should be reachable from the network that can reach the MISP web interface.

Generated by OpenCVE AI on September 21, 2026 at 13:20 UTC.

Remediation

Vendor Solution

The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method—regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other—triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.

OpenCVE Recommended Actions

  • Apply the official patch found in commit ef4dc19c6 or upgrade to MISP 2.5.47 or newer
  • Ensure the login endpoint is only accessible via POST or PUT by configuring the web server to reject other methods
  • Review logs for suspicious login attempts and enable additional monitoring or alerts for brute‑force activity

Generated by OpenCVE AI on September 21, 2026 at 13:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Mon, 21 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:   - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked  -  the email OTP two-factor authentication step was skipped, defeating the second factor of authentication  - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47
Title MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)
Weaknesses CWE-20
CWE-285
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-21T12:35:26.533Z

Reserved: 2026-09-21T12:35:24.635Z

Link: CVE-2026-94379

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-21T13:17:13.200

Modified: 2026-09-21T13:17:13.310

Link: CVE-2026-94379

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T13:30:16Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-285

    Improper Authorization