{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107276", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-10-07T15:36:46.122Z", "datePublished": "2026-10-07T15:36:49.564Z", "dateUpdated": "2026-10-07T15:36:49.564Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["UsersController (email OTP login)"], "product": "MISP", "programFiles": ["app/Controller/UsersController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.</p><p>Preconditions:</p><p>- The target MISP instance has email OTP login enabled.</p><p>- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).</p><p>- The attacker can issue two HTTP POST requests in close temporal proximity.</p><p>Impact:</p><p>- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.</p><p>- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-111", "descriptions": [{"lang": "en", "value": "CAPEC-111 Race Condition"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:34:47Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-10-07T15:36:49.564Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/ba95e67d5"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.</p>"}], "value": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session."}], "title": "MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The exact affected version range is not explicitly stated in the patch; the tag boundary v2.5.48 with 39 commits after the fix suggests the fix landed shortly after that tag, but the precise first-fixed version is unconfirmed.", "The CAPEC-111 mapping is the closest available; no CAPEC specifically covers OTP replay via race condition, so this is the best-fit pattern.", "CVSS AC:H assumes the race window is narrow and requires precise timing; if the Redis round-trip latency is large, exploitation may be easier, but no evidence supports lowering AC.", "The commit message states the issue was 'found during the internal review, not externally reported,' but no specific individual is named as finder, so no finder credit is assigned.", "PR:N assumes the attacker obtains the OTP through out-of-band means (email interception); if MISP requires prior authentication to request an OTP, PR could be L."], "capecRationale": [{"capecId": "CAPEC-111", "rationale": "The attack pattern involves an adversary issuing two or more concurrent requests to exploit a non-atomic check-and-use sequence on a shared resource (the OTP in Redis). CAPEC-111 directly describes exploiting timing dependencies between sub-processes. This is the closest CAPEC to the observed vulnerability; no more specific CAPEC for OTP replay via race condition exists in the CAPEC catalog."}], "commit": "ba95e67d545efa313435ae39dd481879d72e72e6", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N: Exploitation occurs over the network via HTTP POST. AC:H: Exploiting the race condition requires precise timing of two concurrent requests so both read the OTP before either deletes it; this is non-trivial to achieve reliably. AT:N: No data corruption or manipulation is required. PR:N: The attacker does not need prior authentication to MISP; they only need possession of a valid OTP (e.g., intercepted email). UI:N: No victim interaction beyond the initial login flow is needed. VC:N: No direct confidentiality loss of system data. VI:L: The one-time-use property of the OTP is violated, allowing a second authenticated session. VA:N: No availability impact. SC/SI:L: Limited integrity impact on the authentication process; no cross-system impact. SA:N: No impact on security authority.", "fixSummary": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.", "generatedAt": "2026-10-07T15:34:47.392474Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0", "patchSummary": "In UsersController::email_otp(), the $redis->del() call was moved from after the hash_equals comparison into the if-condition as an additional conjunct. The condition now requires $redis->del('misp:otp:' . $user_id) === 1, meaning only the request whose delete actually removed the key (returning 1) can proceed to Auth->login(). A $this->Session->delete('email_otp_user') call was added before the login step to clean up session state. Net change: 6 insertions, 3 deletions in one file.", "patchTruncated": false, "patches": [{"commit": "ba95e67d545efa313435ae39dd481879d72e72e6", "date": "Wed, 23 Sep 2026 16:26:22 +0200", "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0", "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/ba95e67d5.patch", "subject": "fix: [login] Let only one request spend an e-mailed OTP"}], "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:34:47Z", "version": "2.0.3"}, "subject": "fix: [login] Let only one request spend an e-mailed OTP", "tagVersionBoundary": {"commits_after_fix": 39, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-362", "rationale": "The OTP stored in Redis is a shared resource accessed by concurrent HTTP requests. The original code performed read, compare, and delete as separate non-atomic operations, allowing two concurrent requests to both read and validate the same OTP before either deletes it. This is a textbook race condition on a shared resource."}, {"cweId": "CWE-367", "rationale": "The check (reading and comparing the OTP) and the use (logging in) are separated in time, and the state (OTP presence in the store) can change between the two steps due to a concurrent request. This is a TOCTOU variant of the race condition."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (ba95e67d545efa313435ae39dd481879d72e72e6): fix: [login] Let only one request spend an e-mailed OTP", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/ba95e67d5.patch"], "timestamp": "2026-09-23T14:26:22Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20315"}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["UsersController (email OTP login)"], "product": "MISP", "programFiles": ["app/Controller/UsersController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: <2.5.48"}], "id": "CVE-2026-107276", "lastModified": "2026-10-07T16:17:47.340", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:34:47Z", "version": "2.0.3"}}]}, "published": "2026-10-07T16:17:47.213", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/ba95e67d5"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-367"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{}