CVE-2026-56425: Azure AD OAuth 2.0 Auth Bypass Vulnerability

CVE-2026-56425 Overview

CVE-2026-56425 affects the Azure Active Directory (AAD) authentication plugin in MISP, the open-source threat intelligence sharing platform. The plugin's OAuth 2.0 authorization flow contains multiple weaknesses that allow attackers to hijack authenticated sessions and bypass cross-site request forgery (CSRF) protections. The implementation reuses the PHP session_id() value as the OAuth state parameter, fails to regenerate the session identifier after login, and does not enforce HTTPS for the configured redirect URI. The flaw is tracked under CWE-384: Session Fixation.

Critical Impact
An attacker can fixate a victim's session identifier before authentication and reuse the same identifier after successful login, gaining full access to the victim's MISP account.

Affected Products

MISP AAD Authentication Plugin (OAuth 2.0 / Azure Active Directory integration)
MISP versions prior to commit 146bc40ad6e10a44f01e8ed62d5f7bc9c06cc4fa
Deployments using app/Plugin/AadAuth/Controller/Component/Auth/AadAuthenticateAuthenticate.php

Discovery Timeline

2026-06-22 - CVE-2026-56425 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56425

Vulnerability Analysis

The MISP AAD authentication component implements OAuth 2.0 in a manner that violates several protocol security requirements. The most consequential defect is the use of the PHP session identifier as the OAuth state parameter. Because session IDs are long-lived authentication credentials, embedding them in OAuth redirect URLs exposes valid tokens through browser history, HTTP Referer headers, reverse proxy access logs, and any third-party infrastructure that participates in the authorization flow.

The authentication routine also omits a call to session_regenerate_id() after successful login. As a result, the session identifier presented to the user before authentication remains valid after the user is logged in. An attacker who plants a known session identifier in the victim's browser can later use the same identifier to assume the authenticated session.

Additional weaknesses compound the risk. The OAuth state value is not implemented as a single-use cryptographic nonce, weakening CSRF defenses on the OAuth callback. The redirect URI is not constrained to HTTPS, permitting authorization codes and access tokens to traverse the network in plaintext. OAuth error responses containing attacker-controlled GET parameters are written to logs verbatim, enabling log injection and audit-record corruption.

Root Cause

The root cause is conflation of the OAuth state parameter with the PHP session identifier, combined with an explicitly disabled session_regenerate_id() call. The original code comment in the patch indicates the developer disabled session regeneration because it broke the AAD flow, leaving the implementation vulnerable to session fixation [CWE-384].

Attack Vector

An attacker initiates the OAuth flow against a target MISP instance and captures the generated session identifier. The attacker then forces the victim's browser to adopt that identifier through a cookie injection or a crafted link. After the victim completes Azure AD authentication, the session identifier remains valid, and the attacker reuses it to access MISP as the authenticated user.

php

 	session_start();
 }
 
-//  Generating a new session will fail the further flow of AAD. 
-//	session_regenerate_id();
-
 class AadAuthenticateAuthenticate extends BaseAuthenticate
 {

Source: MISP commit 146bc40 — the pre-patch code shows session_regenerate_id() commented out, which the fix removes by introducing proper session rotation after successful authentication.

Detection Methods for CVE-2026-56425

Indicators of Compromise

OAuth callback requests containing a state parameter that matches the format of a PHP session identifier (26+ alphanumeric characters) rather than a random nonce.
MISP audit logs containing control characters, embedded newlines, or unusually long values inside OAuth error parameter fields.
Multiple successful AAD logins from disparate source IP addresses reusing the same session cookie value.
HTTP Referer headers in upstream proxy logs that leak state= values matching internal MISP session cookies.

Detection Strategies

Review reverse proxy and web server access logs for OAuth redirect URLs that expose session identifier values in query strings.
Correlate MISP authentication events against source IP and User-Agent diversity to identify session reuse across distinct clients.
Alert on MISP audit log entries that contain non-printable characters or line breaks within OAuth error fields, indicating possible log injection.

Monitoring Recommendations

Forward MISP web server, application, and audit logs to a centralized SIEM and parse OAuth state, code, and error parameters as discrete fields.
Monitor for HTTP responses on the /users/login/aad callback that issue Set-Cookie headers without subsequently rotating the session identifier.
Track use of non-HTTPS OAuth redirect URIs in the MISP configuration and alert on any configuration drift.

How to Mitigate CVE-2026-56425

Immediate Actions Required

Update MISP to a version that includes commit 146bc40ad6e10a44f01e8ed62d5f7bc9c06cc4fa or later.
Invalidate all active MISP sessions and force users to re-authenticate through AAD.
Audit the AAD application configuration in Azure to ensure the registered redirect URI uses HTTPS only.
Review web server, proxy, and SIEM logs for historical exposure of session identifiers in OAuth state parameters.

Patch Information

The upstream fix in MISP commit 146bc40 introduces a dedicated cryptographically random OAuth state value, single-use state validation with invalidation after use, constant-time comparison via hash_equals(), session identifier rotation after successful authentication, enforcement of HTTPS-only redirect URIs, and sanitized length-limited logging of OAuth error parameters.

Workarounds

Disable the AAD authentication plugin and revert to local MISP authentication until the patch is applied.
Place MISP behind a TLS-terminating reverse proxy configured to redirect all HTTP traffic to HTTPS and to strip the Referer header on outbound OAuth requests.
Restrict the registered AAD application redirect URI in Azure to an exact HTTPS URL, blocking any plaintext callback.

bash

# Apply the upstream patch to an existing MISP deployment
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout 146bc40ad6e10a44f01e8ed62d5f7bc9c06cc4fa -- \
  app/Plugin/AadAuth/Controller/Component/Auth/AadAuthenticateAuthenticate.php
sudo systemctl restart apache2