CVE-2026-107276

MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect. Preconditions: - The target MISP instance has email OTP login enabled. - The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering). - The attacker can issue two HTTP POST requests in close temporal proximity. Impact: - The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions. - This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted. Affected versions: <2.5.48

• CWE-362
• CWE-367

• https://github.com/MISP/MISP/commit/ba95e67d5

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107269Gophish through 0.12.1 contains a timing discrepancy vulnera…3.7
• CVE-2026-10727An OS command injection vulnerability in Ivanti EPMM before …7.2
• CVE-2026-107270Gophish through 0.12.1 contains an insecure direct object re…7.1
• CVE-2026-107271Gophish through 0.12.1 contains a rate limit bypass vulnerab…5.3
• CVE-2026-107272Gophish through 0.12.1 contains stored and reflected cross-s…4.7
• CVE-2026-107273Gophish 0.11.0 through 0.12.1 contains a server-side request…4.3
• CVE-2026-107278MISP contains a validation flaw in its object synchronizatio…5.3
• CVE-2026-10729An HTML injection vulnerability in the notification email fo…1.2
• CVE-2026-1073The Purchase Button For Affiliate Link plugin for WordPress …4.3
• CVE-2026-10731SQL injection in the ‘two_steps_auth_code’ parameter process…9.3
• CVE-2026-107313pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7…4.2
• CVE-2026-10732All versions of the package decompress are vulnerable to Arb…6.4