CVE-2026-90961

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.46

Description The LdapAuth and LinOTPAuth authentication plugins contain an authentication bypass. The LdapAuthenticate and LinOTPAuthenticate functions fail to implement the checkFields() input validation guard, allowing email and password fields from login requests to be processed without verifying they are non-empty strings. In the LDAP authenticator, an empty or null password is sent to ldap bind(), which may be accepted as a successful unauthenticated bind by many LDAP directory servers. This allows an attacker with a valid user email address to authenticate without a password. Non-string values may also cause TypeErrors or be misinterpreted in findUser(). In the LinOTP authenticator, non-string credentials can be concatenated into verification requests, and empty passwords may be accepted against stored hashes of empty strings. Additionally, auto-provisioned LDAP accounts may be assigned and store a hash of an empty password, allowing access via mixed-authentication fallback if the user is no longer in LDAP. Exploitation requires the affected plugin to be enabled and knowledge of a valid email address, granting the attacker the full privileges of the impersonated user.

Recommendations Update MISP to version 2.5.46 or later. As a temporary workaround, disable the LdapAuth and LinOTPAuth plugins until the update is applied.