CVE-2026-103655

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user. Preconditions: - The target user has TOTP-based two-factor authentication enabled. - The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client). - The replay must occur within the TOTP validity period. Security impact: - Unauthorized account access by replaying a captured one-time code. - Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user. Affected versions: <v2.5.48.

• CWE-294

• https://github.com/MISP/MISP/commit/a020fa47b

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103590QloApps through 1.7.0 contains a reflected cross-site script…5.4
• CVE-2026-103591DeepWiki-Open through commit d92819a contains an unauthentic…7.5
• CVE-2026-103592simple-php-router through 5.4.1.7 contains an IP restriction…6.5
• CVE-2026-1036The Photo Gallery by 10Web – Mobile-Friendly Image Gallery p…5.3
• CVE-2026-103641A flaw was found in GEGL. The Radiance HDR loader reads past…5.5
• CVE-2026-103651MISP contains a vulnerability in its one-time password (OTP)…7.6
• CVE-2026-103656Rejected reason: this is rejected
• CVE-2026-103659MISP contains an authorization bypass in the event flattenin…7.1
• CVE-2026-103662MISP contains a reflected cross-site scripting (XSS) vulnera…5.1
• CVE-2026-103664MISP contains a reflected cross-site scripting (XSS) vulnera…4.8
• CVE-2026-103678A flaw was found in tnef. An attacker can exploit this vulne…5.4
• CVE-2026-103679A flaw was found in tnef. A remote attacker could exploit th…6.5