CVE-2026-10611: MISP Authentication Bypass Vulnerability

CVE-2026-10611 Overview

CVE-2026-10611 is an authentication bypass vulnerability in MISP (Malware Information Sharing Platform) affecting deployments that combine LDAP mixed authentication with mandatory one-time password (OTP) enforcement. When LdapAuth.mixedAuth=true and Security.require_otp=true are configured together, the application establishes an authenticated session during the beforeFilter phase before the OTP challenge is enforced. An attacker holding valid LDAP credentials can authenticate through the plugin-backed flow and then navigate directly to any internal application URL, bypassing the TOTP, HOTP, or email OTP step entirely. The flaw is classified under [CWE-287: Improper Authentication].

Critical Impact
Attackers with valid LDAP credentials can fully bypass MISP's mandatory OTP layer, defeating multi-factor authentication and gaining direct access to threat intelligence data.

Affected Products

MISP deployments with LdapAuth.mixedAuth=true
MISP deployments with Security.require_otp=true
MISP installations using plugin-based authentication with mandatory OTP enforcement

Discovery Timeline

2026-06-02 - CVE-2026-10611 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10611

Vulnerability Analysis

The vulnerability is an authentication bypass affecting MISP's multi-factor authentication workflow. MISP supports plugin-based primary authentication, including LDAP, alongside a secondary OTP challenge when Security.require_otp is enabled. The intended flow requires users to complete the OTP verification page after primary credential validation before any authenticated session is granted.

In vulnerable builds, the session is established too early. During the CakePHP beforeFilter lifecycle phase, the LDAP authentication plugin authenticates the user and persists session state before the controller logic redirects to the OTP challenge. Because the session is already authenticated, the OTP page becomes effectively optional. An attacker who controls the request flow can submit valid LDAP credentials, intercept the redirect to the OTP page, and instead request any other authenticated URL within MISP.

The impact is loss of confidentiality for the affected user account, including access to event data, attributes, and any threat intelligence the user is authorized to view. Integrity and availability remain unaffected per the CVSS metrics.

Root Cause

The root cause is incorrect ordering of authentication checks within the request lifecycle. The OTP requirement check executes after the plugin-backed login establishes the session, rather than gating session creation on completion of the second factor. This is a classic broken authentication flow where a mandatory step in the state machine can be skipped via direct URL navigation.

Attack Vector

Exploitation requires valid primary LDAP credentials, which raises the bar but does not eliminate risk in environments where LDAP credentials are phished, reused, or leaked. The attacker authenticates through the LDAP login endpoint, receives the session cookie at the beforeFilter stage, then issues an HTTP request to an authenticated MISP endpoint such as /events/index instead of following the redirect to the OTP page. The server honors the session and serves protected content.

The vulnerability mechanism is described in the upstream patch commit, which restructures the authentication flow so that OTP requirements are evaluated immediately after plugin authentication and before any session state is committed.

Detection Methods for CVE-2026-10611

Indicators of Compromise

Authenticated MISP session activity from a user account without a corresponding successful OTP verification event in application logs.
HTTP access patterns showing LDAP login success followed immediately by requests to non-OTP endpoints, skipping /users/otp or equivalent.
Logins from unexpected source IP addresses for accounts that should always present an OTP challenge.

Detection Strategies

Correlate MISP application logs to confirm every successful LDAP authentication is followed by a completed OTP submission for the same session identifier.
Alert on session identifiers that issue authenticated requests to protected resources before an OTP success log entry is recorded.
Review reverse proxy or web server logs for sequences where the OTP challenge URL is never requested between login and protected resource access.

Monitoring Recommendations

Enable verbose authentication logging in MISP and forward logs to a centralized SIEM for correlation across login, OTP, and resource access events.
Monitor LDAP account lockouts, credential stuffing patterns, and impossible-travel logins against MISP, since stolen primary credentials are the prerequisite for this bypass.
Track configuration drift on LdapAuth.mixedAuth and Security.require_otp to ensure expected enforcement remains in place.

How to Mitigate CVE-2026-10611

Immediate Actions Required

Apply the upstream MISP patch from commit 39b3cb15aac4318afdd2ab63b96c2eac12b271fe to enforce OTP checks before session establishment.
Force-expire all active MISP sessions after patching to ensure no pre-existing bypassed sessions persist.
Audit LDAP-backed accounts for unexpected activity since the deployment of mixed authentication with OTP.
Rotate credentials for any account showing authenticated activity without a matching OTP verification log entry.

Patch Information

The fix is available in the MISP repository via the GitHub commit 39b3cb15aac4318afdd2ab63b96c2eac12b271fe. The patch ensures OTP requirements are evaluated immediately after plugin authentication and redirects users to the appropriate OTP challenge before any authenticated session is established. Administrators should pull the latest MISP release containing this commit and redeploy.

Workarounds

Temporarily disable LdapAuth.mixedAuth until the patched version is deployed, falling back to standard LDAP authentication with OTP integrated into the primary login flow.
Restrict MISP access to trusted networks via firewall rules or reverse proxy ACLs to reduce exposure while the patch is applied.
Enforce strong, unique LDAP credentials and enable LDAP-side account lockout to limit the value of stolen primary credentials.

bash

# Configuration example - temporarily disable LDAP mixed auth until patched
# In MISP config.php
'LdapAuth' => [
    'mixedAuth' => false,
],
'Security' => [
    'require_otp' => true,
],