CVE-2026-95754: MISP UsersController Auth Bypass Vulnerability

CVE-2026-95754 Overview

CVE-2026-95754 affects MISP (Malware Information Sharing Platform), an open-source threat intelligence platform. The vulnerability resides in the UsersController::login() method, where the pre-authentication database query used by the TOTP (Time-based One-Time Password) two-factor authentication branch omits the User.disabled column from its SELECT fields list. As a result, the guard that should reject disabled accounts at the TOTP step evaluates against a missing key and behaves as a no-op. A disabled, TOTP-enrolled user can reach the TOTP verification prompt before being rejected. The MISP commit message notes the issue is harmless in practice because the subsequent identify() call re-validates the user.

Critical Impact
Minor information disclosure in login flow. A disabled, TOTP-enrolled account receives a TOTP prompt instead of immediate rejection, and a PHP Undefined array key warning is written to application logs. Authentication is still denied by the downstream identify() call.

Affected Products

MISP (Malware Information Sharing Platform) prior to commit 3df982ab1
app/Controller/UsersController.phplogin() TOTP branch
Deployments with TOTP two-factor authentication enabled

Discovery Timeline

2026-09-22 - CVE-2026-95754 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95754

Vulnerability Analysis

The defect is an authorization logic flaw classified under [CWE-285] Improper Authorization. In UsersController::login(), MISP performs a pre-authentication lookup to retrieve credential material required for the TOTP verification branch. The query selects only User.password, User.totp, and User.hotp_counter. When the TOTP branch later reads $unauth_user['User']['disabled'], that key does not exist in the result array. PHP emits an Undefined array key warning, and the expression evaluates as null, which is falsy. The disabled-user guard therefore never trips at this stage.

The practical consequence is limited. A disabled account with TOTP enrolled proceeds to the TOTP challenge instead of receiving an immediate rejection. The downstream identify() call re-validates the account and rejects disabled users, so no session is issued and no data is exposed beyond the difference in login response.

Root Cause

The root cause is an incomplete field projection in a CakePHP find('first', ...) query. The fields list omits User.disabled, so the loaded model lacks the column required by the subsequent disabled-user guard. The guard's reliance on a possibly absent array key, without an isset() check or a strict boolean comparison, causes it to silently degrade to a no-op.

Attack Vector

An unauthenticated remote attacker submits an email address belonging to a disabled TOTP-enrolled account to the login endpoint. The response returns a TOTP prompt instead of a rejection. This behavioral difference can be used to enumerate whether a given account is disabled and TOTP-enrolled. No credential compromise, session issuance, or privilege escalation results from the flaw.

php

            }
            $unauth_user = $this->User->find('first', [
                'conditions' => ['User.email' => $this->request->data['User']['email']],
-                'fields' => ['User.password', 'User.totp', 'User.hotp_counter'],
+                'fields' => ['User.password', 'User.totp', 'User.hotp_counter', 'User.disabled'],
                'recursive' => -1,
            ]);
            if ($unauth_user) {

Source: MISP commit 3df982ab1

Detection Methods for CVE-2026-95754

Indicators of Compromise

PHP Undefined array key "disabled" warnings originating from UsersController.php in web server or application logs.
Login requests to /users/login for known disabled accounts that receive a TOTP challenge response rather than an immediate failure.
Repeated login attempts against disabled accounts, indicating account status enumeration.

Detection Strategies

Grep application logs for Undefined array key messages tied to the login() method and correlate with source IP addresses.
Compare HTTP response bodies and status codes for disabled versus active accounts to identify enumeration probes.
Alert on unusually high login attempt rates targeting accounts previously flagged as disabled in the MISP user database.

Monitoring Recommendations

Enable PHP error logging at warning level and forward MISP application logs to a centralized log platform for correlation.
Track authentication endpoint traffic and baseline normal login volume per source IP to surface enumeration bursts.
Review MISP audit logs for administrative changes to user disabled status alongside subsequent login activity.

How to Mitigate CVE-2026-95754

Immediate Actions Required

Apply the upstream MISP commit 3df982ab1, which adds User.disabled to the pre-authentication field list in the TOTP branch.
Update MISP deployments to the release incorporating the fix and restart the web server to reload the patched controller.
Suppress or filter the transient PHP Undefined array key warning at ingress log filters if the patch cannot be applied immediately.

Patch Information

The fix is delivered in MISP commit 3df982ab1 to app/Controller/UsersController.php. It adds User.disabled to the fields array of the pre-authentication find('first', ...) query so the TOTP branch guard evaluates against real data. Refer to the MISP GitHub commit for the full diff.

Workarounds

Ensure disabled user accounts also have TOTP secrets cleared, so the TOTP branch is not reached for those accounts.
Restrict access to the MISP login endpoint using network controls or a reverse proxy allowlist to limit exposure to unauthenticated enumeration.
Rate-limit authentication requests at the web server or WAF layer to raise the cost of account status enumeration.

bash

# Apply the upstream fix
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 3df982ab1
sudo systemctl restart apache2