CVE-2026-103651

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A flaw exists in the one-time password (OTP) authentication flow that allows the replay of a consumed HMAC-based One-Time Password (HOTP) token and the rewinding of the token counter. The issue occurs because the verification logic compares the submitted token against a counter value cached in the user session instead of the authoritative counter in the database. Since the cached counter is not updated after a token is used, an attacker with a valid session (where the password has been submitted but the OTP is pending) can reuse a previously used token to bypass the second authentication factor and gain unauthorized access. This process also corrupts the HOTP counter state, which may invalidate future legitimate tokens.

Recommendations Update to version 2.5.48 or later.