CVE-2026-107180: MISP TOTP Auth Bypass Vulnerability

CVE-2026-107180 Overview

CVE-2026-107180 is an authentication bypass vulnerability in MISP (Malware Information Sharing Platform) instances configured with mandatory TOTP enrollment (Security.otp_required). The flaw allows an authenticated user who has not completed Time-based One-Time Password (TOTP) enrollment to bypass the forced two-factor setup by issuing non-browser requests. Affected request shapes include AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, and automation actions. Because these machine-readable requests cannot follow the HTTP redirect used by the browser flow to the TOTP enrollment page, the enforcement guard was simply skipped. The vulnerability affects MISP versions prior to 2.5.48 and maps to [CWE-287] Improper Authentication.

Critical Impact
An authenticated user on an otp_required instance can retain full access indefinitely without ever enrolling in TOTP, nullifying the instance-level two-factor authentication policy.

Affected Products

MISP (Malware Information Sharing Platform) versions prior to 2.5.48
MISP instances with Security.otp_required enabled
MISP deployments relying on instance-level mandatory TOTP enrollment

Discovery Timeline

2026-10-07 - CVE-2026-107180 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-107180

Vulnerability Analysis

The vulnerability resides in app/Controller/AppController.php, which enforces the mandatory TOTP enrollment check for authenticated users. The enforcement logic distinguished browser-driven requests from machine-readable ones using the $isUserRequest flag, computed as !$this->_isRest() && !$this->request->is('ajax') && !$this->_isAutomation(). When the request was identified as non-browser (REST, AJAX, or automation), the controller returned early without evaluating the TOTP enrollment requirement. An authenticated session without a configured TOTP secret could therefore issue API calls, .json-formatted requests, or restSearch queries and operate with full application privileges. The enforcement failure applied even on instances where administrators explicitly set Security.otp_required to true.

Root Cause

The root cause is incomplete enforcement of a security policy across all request shapes. The TOTP guard was designed around the browser-based redirect flow and relied on the client following an HTTP redirect to /users/totp_new. Non-browser clients cannot follow this redirect transparently, so the authors excluded them from the check rather than returning a denial response. This created an authentication bypass for every programmatic entry point.

Attack Vector

An authenticated user without a configured TOTP secret issues any non-browser request to the MISP instance. Suitable request shapes include REST API endpoints with an Accept: application/json header, URLs ending in .json, XHR calls, and automation actions. The controller skips the enrollment guard and processes the request normally, granting the user full application access without ever completing the mandatory second-factor setup.

php

// Initial fix (commit 8deb0619e): add guard for AJAX requests
        $isUserRequest = !$this->_isRest() && !$this->request->is('ajax') && !$this->_isAutomation();
        // An unenrolled user on an otp_required instance must not slip past the
        // TOTP setup with an AJAX request; refuse it, since an XHR cannot follow
        // the redirect the browser path takes. API keys are unaffected.
        if (
            !$isUserRequest &&
            $this->request->is('ajax') &&
            empty($user['totp']) &&
            Configure::read('Security.otp_required') &&
            empty($user['Role']['perm_skip_otp']) &&
            !$this->_isControllerAction(['users' => ['terms', 'change_pw', 'logout', 'login', 'totp_new']])
        ) {
            throw new ForbiddenException(__('You must configure TOTP before continuing.'));
        }
// Source: https://github.com/MISP/MISP/commit/8deb0619e

Detection Methods for CVE-2026-107180

Indicators of Compromise

Authenticated REST API or .json requests from user accounts that have no TOTP secret configured on an otp_required instance.
Successful restSearch, automation, or AJAX activity from accounts whose last interactive login did not complete the /users/totp_new flow.
User sessions active beyond the TOTP grace period without a corresponding TOTP enrollment event in the audit log.

Detection Strategies

Query the MISP user table for accounts where totp is empty, Role.perm_skip_otp is false, and Security.otp_required is enabled, then correlate against recent API usage.
Inspect web server access logs for .json URLs or REST endpoints hit by accounts that never issued a GET /users/totp_new or POST /users/totp_new.
Monitor for logged_by_authkey being false while the request type is non-browser, which indicates a session-authenticated API call that should have been blocked.

Monitoring Recommendations

Enable MISP audit logging and forward authentication and API events to a centralized log store for correlation.
Alert on new API key creation by users who have not completed TOTP enrollment, since this can be used to launder session access into a persistent credential.
Review the output of admin users list for accounts lacking TOTP on instances where it is mandated by policy.

How to Mitigate CVE-2026-107180

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which contains the broadened enforcement guard from commit 6b527ba6e.
Audit all user accounts on otp_required instances and disable those without a configured TOTP secret until enrollment is completed.
Rotate or revoke API keys issued to unenrolled users during the exposure window, since those credentials may have been minted via a bypassed session.

Patch Information

The fix is delivered in two commits to app/Controller/AppController.php. The initial patch (GitHub MISP Commit 8deb0619) added a ForbiddenException for AJAX requests originating from unenrolled sessions. The follow-up patch (GitHub MISP Commit 6b527ba) broadened the guard to refuse every non-browser request shape by removing the AJAX-only condition and adding an exemption only for identities authenticated via API key (logged_by_authkey). Both changes are included in MISP 2.5.48.

php

// Final fix (commit 6b527ba6e): refuse every non-browser session request
        $isUserRequest = !$this->_isRest() && !$this->request->is('ajax') && !$this->_isAutomation();
        // An unenrolled user on an otp_required instance must not slip past the TOTP setup by
        // asking for a machine-readable format; refuse the request, since neither an XHR nor a
        // .json caller can follow the redirect the browser path takes. An identity that came
        // from an API key is not a browser session and is left alone.
        if (
            !$isUserRequest &&
            empty($user['logged_by_authkey']) &&
            empty($user['totp']) &&
            Configure::read('Security.otp_required') &&
            empty($user['Role']['perm_skip_otp']) &&
// Source: https://github.com/MISP/MISP/commit/6b527ba6e

Workarounds

Temporarily disable REST API and automation endpoints at the reverse proxy for user sessions until the upgrade is deployed.
Set Role.perm_skip_otp only for service accounts that authenticate exclusively via API keys, and ensure all interactive users have completed TOTP enrollment before re-enabling API access.
Enforce TOTP enrollment out-of-band by provisioning accounts in a disabled state and activating them only after confirming TOTP setup.

bash

# Configuration example: verify MISP version and OTP enforcement
cd /var/www/MISP
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.48
sudo -u www-data app/Console/cake Admin setSetting Security.otp_required true
sudo -u www-data app/Console/cake Admin getSetting Security.otp_required