CVE-2026-85216

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An authentication bypass exists in the LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components failed to replicate the credential validation checks of CakePHP's FormAuthenticate implementation, allowing empty or non-string values to reach authentication mechanisms. In the LDAP path, an attacker with a valid directory user's email could submit an empty password; if the LDAP server accepts unauthenticated binds via the ldap bind() function, the attacker could impersonate the user. In the LinOTP component, invalid credential types were not rejected, and when mixed authentication was enabled, empty passwords could be validated against local hashes. Additionally, LDAP-provisioned accounts could be created with empty local passwords, allowing authentication via the local fallback mechanism if LDAP resolution failed. Successful exploitation allows a remote unauthenticated attacker to impersonate users, potentially gaining administrative access to sensitive threat-intelligence data and system configurations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.