CVE-2026-94379

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47

Description The login() function in UsersController.php contains insufficient HTTP method validation. The system uses an allowlist that only checks for POST and PUT methods before applying security controls. An unauthenticated attacker can use other HTTP methods to bypass bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. This allows for unlimited credential-guessing attempts without rate-limiting, bypasses two-factor authentication, and removes the audit trail for failed login attempts, potentially leading to unauthorized access.

Recommendations Update to version 2.5.47 or later.