CVE-2026-103651

Summary

MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter.

The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. The stale cached counter still matches the replayed token, granting a second successful authentication and effectively rewinding the counter state.

Preconditions:

• The target user has HOTP (paper token) second-factor authentication enabled.

• The attacker possesses a valid session in which the password step has already been completed (the OTP step is pending).

• The attacker has access to at least one HOTP token value (e.g., a paper token list).

Security impact:

• Bypass of the second authentication factor, allowing unauthorized access to a user's MISP account.

• Corruption of the HOTP counter state, potentially invalidating subsequent legitimate tokens or enabling further replays.

Affected versions: <2.5.48.

Affected Software

Weaknesses

• CWE-362: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
• CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/MISP/MISP/commit/f34aee2c7

• ←Previous
• Next→