CVE-2026-107276

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A race condition exists in the email-based one-time password (OTP) login flow. This occurs because the OTP value is read from the shared store, validated, and deleted in separate non-atomic steps. Consequently, if two HTTP requests using the same valid OTP are submitted concurrently, both may successfully authenticate and establish sessions before the deletion takes effect. This violates the one-time-use guarantee of the OTP and may facilitate unauthorized access if a code is intercepted or shared.

Recommendations Update to version 2.5.48 or later.