CVE-2026-94379: MISP Authentication Bypass Vulnerability

CVE-2026-94379 Overview

CVE-2026-94379 is an authentication control bypass in the Malware Information Sharing Platform (MISP). The login() function in app/Controller/UsersController.php enforced brute-force protection, email one-time-password (OTP) validation, and login-failure logging only for HTTP POST and PUT requests. An unauthenticated attacker can submit login requests using other HTTP methods to bypass all three controls simultaneously. This defect maps to Improper Input Validation [CWE-20] and affects MISP versions prior to 2.5.47.

Critical Impact

Attackers can perform unlimited credential-guessing against MISP login endpoints while bypassing email-based two-factor authentication and evading audit logging.

Affected Products

• MISP (Malware Information Sharing Platform) versions prior to 2.5.47
• Deployments exposing the /users/login endpoint to untrusted networks
• MISP instances relying on email OTP as a second authentication factor

Discovery Timeline

• 2026-09-21 - CVE-2026-94379 published to the National Vulnerability Database
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94379

Vulnerability Analysis

The login() action in MISP's UsersController.php gated three security-critical code paths behind an HTTP method allowlist. The controller invoked $this->request->is(['post', 'put']) before initializing the Bruteforce component, evaluating the blocklist, requesting the email OTP, and logging failed authentication attempts. Any request using an HTTP method outside that allowlist skipped the entire protected block while still traversing the remainder of the login flow. The result is a bypass primitive reachable by any unauthenticated network client.

Root Cause

The root cause is an allowlist that does not enumerate every method capable of carrying a request body or triggering credential evaluation. Using an allowlist for enforcement rather than a denylist for exclusion inverted the intended trust boundary. Security controls should apply to every non-GET code path that processes credentials, not only to POST and PUT.

Attack Vector

An unauthenticated attacker sends login requests to the MISP /users/login endpoint using an HTTP method other than POST or PUT. The request bypasses the brute-force blocklist check, skips the email OTP second factor, and produces no failure log entry. Repeated requests allow unrestricted credential guessing against any known account without triggering rate limits or generating an audit trail.

     public function login()
     {
         $oldHash = false;
-        if ($this->request->is(['post', 'put'])) {
+        if (!$this->request->is(['get'])) {
             $this->Bruteforce = ClassRegistry::init('Bruteforce');
             if (!empty($this->request->data['User']['email'])) {
                 if ($this->Bruteforce->isBlocklisted($this->request->data['User']['email'])) {

Source: MISP GitHub commit ef4dc19c6. The patch replaces the positive allowlist with a negative check that enforces the controls on any method other than GET.

Detection Methods for CVE-2026-94379

Indicators of Compromise

• Web server access logs showing requests to /users/login using HTTP methods other than GET, POST, or PUT (for example PATCH, DELETE, or OPTIONS)
• High volumes of login requests against a single account with no corresponding entries in the MISP log table or bruteforce blocklist
• Successful authentications for accounts protected by email OTP without a matching OTP delivery event

Detection Strategies

• Alert on any non-standard HTTP method reaching the MISP login endpoint at the reverse proxy or web application firewall
• Correlate authentication attempts recorded in front-end proxy logs against MISP application logs to surface missing failure records
• Baseline expected request-method distributions for /users/login and flag deviations

Monitoring Recommendations

• Forward MISP application logs, web server logs, and reverse-proxy logs into a centralized analytics platform for cross-source correlation
• Track sudden increases in login volume per source IP and per target account
• Monitor the MISP bruteforce table for stagnation while authentication traffic remains elevated

How to Mitigate CVE-2026-94379

Immediate Actions Required

• Upgrade MISP to version 2.5.47 or later, which enforces the security controls on all non-GET methods
• Restrict access to the MISP web interface using network controls, VPN, or IP allowlists until patching is complete
• Rotate credentials for accounts that may have been targeted while the vulnerable version was exposed

Patch Information

The fix is available in the upstream MISP repository as commit ef4dc19c6. The patch modifies app/Controller/UsersController.php so that the Bruteforce component, email OTP validation, and login-failure logging execute for every request method other than GET. Administrators should apply the official 2.5.47 release rather than backporting manually.

Workarounds

• Configure a reverse proxy or WAF rule to reject requests to /users/login unless the method is GET, POST, or PUT
• Enforce network-layer authentication (mutual TLS or VPN) in front of the MISP instance to limit exposure to unauthenticated actors
• Temporarily disable email OTP-only accounts and require certificate-based or SSO authentication where available

# Example nginx rule restricting login endpoint methods
location = /users/login {
    limit_except GET POST PUT { deny all; }
    proxy_pass http://misp_backend;
}